Samsung Knox Kernel Use-After-Free Exposed an App-Reachable Path to Memory Corruption

Summary

CVE-2026-20971 was a use-after-free in Samsung’s PROCA driver. Researchers explained the race and demonstrated limited exploitation primitives; Samsung fixed the issue in its January 2026 security update.

Key points

Samsung’s advisory says CVE-2026-20971 could let a local attacker potentially execute arbitrary code; it affects Android 13–16 versions before the January 2026 Security Maintenance Release.
The bug arose when a procfs read used a task_integrity pointer after a child process’s execve() replaced and freed the object.
LucidBit Labs reported the vulnerable code path across Galaxy S9–S25 and A-series devices, and confirmed the issue on the S21, S22, S24 and A54.
The public research demonstrated a small 32-bit leak, a refcount-related reset_file path and a constrained write primitive, but did not publish a complete takeover exploit.
KCFI blocked one apparent indirect-call route; it did not fix the underlying use-after-free.
Samsung fixed the issue by removing unused code in its January 2026 security update. The article recommends updating supported devices and auditing enterprise patch levels.

Article Details

Attack Vectors: A local attacker can reach the vulnerable Samsung PROCA driver through an app-accessible procfs integrity interface.
The use-after-free occurs when a reader retains a stale task_integrity pointer after the child process executes a new binary and the old integrity object is freed.
Defensive Notes: Install the January 2026 Samsung Security Maintenance Release or later on affected devices.
Enterprises should audit Samsung device patch levels, enforce a minimum patch baseline through MDM or UEM, restrict access from outdated devices, and identify models outside vendor support.