Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel-Level Takeover Security researchers at LucidBit have uncovered a critical use-after-free (UAF) vulnerability in Samsung’s KNOX security subsystem, a flaw that remained hidden for over eight years and could have enabled full device compromise. The bug, patched in Samsung’s January 2026 Android Security Update, affects the PROCA (Process Authenticator) component of KNOX, specifically targeting FIVE (File-based Integrity Verification Engine), a kernel-level integrity tracking system built on Linux’s integrity measurement architecture. The vulnerability stems from improper reference handling in procfs handlers under `/proc/pid/integrity/`, which fetch raw pointers to `task_integrity` objects without maintaining proper locks. This oversight in a preemptive kernel environment allowed attackers to exploit freed memory, leading to potential kernel-level memory corruption and device takeover. ### Affected Devices & Scope The flaw impacts Samsung Galaxy devices from the S9 through S25, including A-series models (e.g., A54), across both Exynos and Qualcomm chipsets. All tested Android versions were vulnerable, with the bug dating back to 2017, when FIVE was first integrated into Samsung’s kernel. ### Exploitation Primitives LucidBit identified three distinct attack vectors from the UAF condition: 1. Memory Leak (DWORD Read) – The `proc_integrity_value_read()` handler could leak data from reclaimed memory, enabling a KASLR bypass without crashing the system. 2. Arbitrary Call (CFI-Blocked) – The `proc_integrity_reset_file()` handler could trigger a function pointer call via a freed `struct file`, but Android’s KCFI (Kernel Control Flow Integrity) restricted redirection to type-compatible functions, neutralizing this vector. 3. Constrained Write via Spinlock – The `proc_integrity_label_read()` handler’s spinlock operations on freed memory could produce a write at offset 0x0c, potentially corrupting pointers or refcounts in reclaimed objects. ### Patch & Mitigation Samsung addressed the flaw in its January 2026 security update, with affected users advised to verify their security patch level (2026-01-01 or later). The discovery highlights the risks of vendor-modified kernel code, where complex object lifetime semantics absent in upstream Linux can introduce long-term vulnerabilities.