Samsung fixed Galaxy KNOX kernel flaw CVE-2026-20971 that exposed devices from the S9 through S25 to local kernel attacks

Updated: 2026.06.23 1M ago 1 sources

Zero-Days & CVEs Urgent Patches Surveillance & Privacy

Samsung patched a high-severity flaw in its KNOX security framework that affected a wide range of Galaxy phones and tablets, including models from the Galaxy S9 through S25. The bug, CVE-2026-20971, was an eight-year-old use-after-free vulnerability in the interaction between the PROCA process authenticator and FIVE kernel integrity system. Researchers said an untrusted app could trigger kernel memory corruption on Android 13, 14, 15, and 16; Samsung fixed it in the January 2026 security release.

Why it matters: This matters because the flaw sat in Samsung’s device-security layer for years across many generations of phones, creating a potential path to deeper device compromise if attackers could get code onto a target device. Samsung users and enterprise mobile admins should make sure affected Galaxy devices have the January 2026 update or later installed.

Sources

Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks

Kevin Townsend 2026.06.23 100% relevant

This article establishes a distinct story about CVE-2026-20971 in Samsung KNOX, including the root cause, affected Galaxy generations, and confirmation that Samsung shipped a fix in January 2026.