PT-2026-2052 · Unknown · Proca Driver
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Samsung KNOX versions prior to SMR Jan-2026 Release 1
Description
A use-after-free race condition exists in the PROCA (process authenticator) kernel driver, a proprietary subsystem designed to prevent unauthorized process execution. The issue occurs during the interaction between PROCA and FIVE (a kernel-side integrity verification subsystem). Specifically, when a process creates a child process and calls
execve(), the task integrity put(old tint) function releases the original security state structure. Due to the preemptive nature of the Android kernel, a thread may be suspended between reading a pointer and using it, allowing proc integrity value read() to resume and call task integrity user read() using a pointer to memory that has already been freed. This flaw can be triggered by an untrusted application to read freed memory before the FIVE subsystem clears it, potentially leading to kernel memory corruption and arbitrary code execution.Recommendations
Update to the January 2026 SMR update.
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Proca Driver