Samsung KNOX Kernel Flaw Sat in Galaxy Phones for 8 Years

Researchers at LucidBit Labs have gone public with a high-severity flaw that quietly lived inside Samsung KNOX for nearly a decade. Tracked as CVE-2026-20971 with a CVSS of 7.8, the bug sat in the kernel components whose entire job is keeping untrusted processes from running loose. The irony writes itself.

Where the bug lives

It's a use-after-free in the handoff between two Samsung subsystems, PROCA and FIVE, which together vouch for the integrity of running processes. When a process forks and calls execve(), the old integrity object is supposed to be swapped out instantly. On Android's preemptive kernel, instantly turns out to be a window. One thread gets paused mid-operation while another is left holding a pointer to memory that has just been freed. Classic use-after-free.

Not trivial, but not theoretical

Exploitation took some doing. Kernel control flow integrity closed off the easy paths, so the researchers leaned on a non-ELF file trick to slip past a reference-count check and reallocate the freed memory in a shape they controlled. From an untrusted app, that opens the door to kernel memory corruption and a much deeper grip on the device.

The affected fleet is broad: Galaxy S9 through S25, the A-series, and both Exynos and Qualcomm builds running Android 13 through 16. That is a lot of phones in a lot of pockets.

The "user interaction required" caveat

Samsung's advisory describes the bug as locally exploitable with user interaction required, which sounds reassuring until you remember that user does not always mean owner. Phones get left on desks, in cafes, in the back of taxis. A handset compromised through brief physical access becomes a quiet bridge into whatever corporate network it later connects to, and attackers have no shortage of ways to chain a local bug with a remote foothold they already have.

The fix, and the bit that gets forgotten

Samsung patched the issue in its January 2026 security update. Which is good news for any phone that has actually installed it. Fleet-wide, that's often the gap nobody owns. IT signs off on the patch existing. End users tap "remind me later" for a fortnight. The CVE keeps quietly working on phones that never restarted.

• Check before you assume. Pull patch-level data from MDM rather than trusting that updates rolled out cleanly.
• Mind the A-series. Cheaper handsets often sit on slower update cadences and get less attention from IT.
• Physical access still matters. A flaw flagged as low-risk because it needs local access is only low-risk until somebody leaves a phone on a bar.

Eight years is a long time for a flaw to live inside the subsystem whose job is to stop exactly this kind of thing. The patch is out. Whether it's actually on the phone in your pocket is a different question.