8-Year-Old Samsung KNOX Vulnerability Exposes Galaxy Devices to Kernel Attacks

LucidBit discovered a critical use-after-free vulnerability in Samsung’s KNOX Process Authenticator (PROCA) within the FIVE integrity engine that affects Galaxy devices from S9 through S25 and some A-series devices across Exynos and Qualcomm variants. The flaw allows memory leaks, a constrained write primitive, and an attempted arbitrary call primitive (limited by Android KCFI), potentially enabling kernel-level memory corruption and complete device takeover; Samsung issued a fix in the January 2026 security update and users should ensure their devices are patched to 2026-01-01 or later.