A particularly serious vulnerability , which remained unseen for almost eight years, has been discovered in Samsung’s KNOX security kernel, affecting a wide range of Galaxy devices, from the Galaxy S9 series to the newer Galaxy S25. The vulnerability, documented as CVE-2026-20971 and rated at a CVSS severity of 7.8, highlights once again how complex modern smartphone security has become.
The discovery was made by researchers at LucidBit Labs, who found that the vulnerability lay in the way two critical KNOX security subsystems, PROCA and FIVE.
How Samsung's security mechanism works
PROCA is a proprietary Android kernel subsystem developed by Samsung to prevent the execution of unauthorized processes . Essentially, it acts as a mechanism to verify the identity of applications and processes running on the device.
See also: Samsung continues rapid rollout of One UI 8 to more Galaxy devices
To confirm that a process is trustworthy, PROCA relies on FIVE, an integrity subsystem that continuously monitors the security status of each process within the operating system kernel. FIVE maintains information about the trust level of each process and ensures that no unauthorized modifications are made.
However, the interaction of these two mechanisms created an unexpected point of weakness.
An extremely small window that could lead to a breach
The researchers found that under certain conditions, a tiny time gap is created when a process transitions from one integrity state to another. Due to the preemptive nature of the Android kernel, a thread of execution can be interrupted just as it reads a memory pointer and before it has a chance to use it.
The result is the creation of a classic "use-after-free" (UAF) scenario, a class of vulnerabilities that occurs when a program continues to use data that has already been freed from memory. Although such bugs are extremely difficult to exploit in practice, they remain particularly dangerous, as they can lead to kernel memory corruption and, under certain conditions, to unauthorized code execution.
Modern defenses made exploitation more difficult but did not prevent it
Samsung had already incorporated protection mechanisms such as Kernel Control Flow Integrity (KCFI), which restricts arbitrary function calls to the system kernel. This technology significantly increased the level of difficulty of a potential attack.
See also: Samsung introduced the Galaxy Book6 Edge
However, the researchers managed to find an alternative way to exploit the problem, using specially crafted files that could not be executed normally by the operating system. Through a series of technical manipulations, they managed to reallocate parts of the memory in a controlled manner and create conditions that could lead to a deeper breach of the device.
Which devices are affected?
The vulnerability affected multiple generations of Samsung devices, including the Galaxy S9 to Galaxy S25 series, several models of the Galaxy A series, as well as devices based on both Exynos and Qualcomm processors.
Samsung fixed the issue via the January 2026 security update, while affected versions of the operating system include Android 13, Android 14, Android 15, and Android 16.
Why even a local vulnerability can be dangerous
On the surface, this vulnerability appears to be local, as it requires some form of interaction with the device. However, experts point out that the concept of “local access” does not necessarily mean that the legitimate owner is always in control of their device.
Smartphones are now permanently connected devices containing personal data, corporate information, passwords and credentials. Even a brief loss of physical control of the device or the installation of a malicious application can create conditions that allow such vulnerabilities to be exploited.
In corporate environments, a successful mobile phone breach could be the first step to accessing internal networks and critical infrastructure.
See also: New leaks for the Samsung Galaxy A27 – Features and changes
The biggest lesson for the cybersecurity industry
The case of CVE-2026-20971 highlights an important reality of modern cybersecurity: Protection mechanisms themselves, no matter how sophisticated, can become attack surfaces when their complexity increases.
For users, the main conclusion is clear: installing the latest security updates is no longer an optional procedure but a necessary condition for protection. For the industry, this vulnerability serves as a reminder that even the most advanced security systems require constant testing and review in the face of increasingly sophisticated threats.
