A critical use-after-free (UAF) vulnerability buried inside Samsung’s Android kernel for nearly eight years has been publicly disclosed, exposing hundreds of millions of Galaxy devices to potential app-to-kernel memory corruption.
The flaw originates in FIVE (File-based Integrity Verification Engine), a proprietary kernel-side integrity subsystem that underpins Samsung’s KNOX security platform.
The vulnerability was uncovered by LucidBit Labs, an offensive security research team, and responsibly disclosed to Samsung.
Samsung Kernel UAF Flaw
A fix was issued in Samsung’s January 2026 Android Security Update, ending an eight-year exposure window that spanned the Galaxy S9 all the way to the Galaxy S25, as well as A-series devices including the A54 across both Qualcomm Snapdragon and Samsung Exynos chipsets.
FIVE assigns every running process a task_integrity object, storing its current integrity level, user-visible integrity value, and related metadata.
Samsung exposes a procfs interface under /proc/pid/integrity/ that allows user space to query this state. The handlers serving these queries fetch a raw pointer to the task_integrity object via the TASK_INTEGRITY(task) macro without ever acquiring a live reference on it.
The problem surfaces during execve(). When a process loads a new binary, the kernel replaces the existing task_integrity with a freshly allocated one and frees the old object.
Because Android runs a fully preemptive kernel, a precise race becomes possible: a procfs reader fetches a raw pointer to a child’s integrity object and gets scheduled out, the child calls execve() and frees the original object, and the reader resumes now operating entirely on freed memory.
LucidBit documented three distinct memory corruption primitives derivable from this flaw:
Primitive 1 — DWORD Leak via proc_integrity_value_read(): The most reliable primitive, this path reads the first word of the freed task_integrity allocation. If the slot is reclaimed before the reader resumes, an attacker can leak arbitrary kernel memory that can be used to bypass KASLR. Critically, this primitive carries no crash risk.
Primitive 2 — Constrained Function Pointer Call via proc_integrity_reset_file(): This path ultimately invokes d_path(), which dereferences a d_dname() function pointer potentially sourced from freed memory. Researchers identified a clever technique using /system/bin/monkey a plain-text system binary present on all tested devices to deterministically reduce the reset_file reference count to exactly 1, enabling the file UAF.
However, Kernel Control Flow Integrity (KCFI) enforced via CONFIG_CFI_CLANG=y on Samsung’s defconfig effectively neutralized this primitive. KCFI validates that indirect call targets match an expected function prototype, blocking redirection to arbitrary kernel addresses and rendering this avenue a dead end.
Primitive 3 — Constrained Write via Spinlock Abuse in proc_integrity_label_read(): The handler acquires a spinlock_t from the freed task_integrity. If the freed slot is reclaimed by another kernel object, the spinlock acquire and release operations produce small writes into the reclaimed memory at offset 0xc.
Though highly constrained, this primitive can potentially corrupt pointer fields, refcounts, or length values, serving as a stepping stone to heap access or chained UAF exploitation out of bounds.
The vulnerability affected every Samsung device tested across all Android versions examined a consistent, cross-chipset impact that underscores how deeply embedded FIVE is across Samsung’s product stack.
Device owners should confirm their patch level reads January 2026 or later by navigating to Settings → Software Update.
This research further demonstrates that KCFI remains one of the most practically effective kernel mitigations in production Android today, having directly neutralized what would otherwise have been an arbitrary function-call primitive.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 vulnerability buried inside Samsung's Android kernel for nearly eight years has been publicly disclosed, exposing hundreds of millions of Galaxy devices to potential app-to-kernel memory corruption.){kind=link}