CVE-2026-21085: Keymaster Trustlet Privilege Escalation

CVE-2026-21085 Overview

CVE-2026-21085 is an out-of-bounds write vulnerability [CWE-787] in the Samsung Keymaster trustlet. The flaw affects Samsung mobile devices running firmware prior to the Security Maintenance Release (SMR) September 2026 Release 1. Local attackers with elevated privileges can write beyond allocated memory bounds within the trusted execution environment. Successful exploitation compromises the confidentiality, integrity, and availability of cryptographic material managed by Keymaster. Samsung disclosed the issue in its September 2026 monthly security bulletin.

Critical Impact
An attacker with privileged local access can corrupt memory inside the Keymaster trustlet, potentially subverting hardware-backed key storage and device attestation.

Affected Products

Samsung mobile devices running firmware prior to SMR Sep-2026 Release 1
Samsung Keymaster trustlet component
Devices relying on the affected trustlet for hardware-backed key management

Discovery Timeline

2026-09-09 - CVE-2026-21085 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-21085

Vulnerability Analysis

The Keymaster trustlet runs inside the Trusted Execution Environment (TEE) on Samsung devices. It handles generation, storage, and use of cryptographic keys isolated from the Android operating system. An out-of-bounds write [CWE-787] in this component allows a local, privileged actor to modify memory outside the intended buffer. Because the trustlet operates in a higher trust boundary than the Android userspace and kernel, memory corruption here has security implications that extend beyond the calling process.

Successful exploitation can influence trustlet state, corrupt adjacent key material, or alter control flow inside the secure world. The Common Weakness Enumeration classification [CWE-787] captures the underlying defect: writing data past the end or before the beginning of an intended buffer.

Root Cause

The root cause is insufficient bounds validation on data processed by the Keymaster trustlet. Input crossing the Normal World to Secure World boundary is written to memory without adequate length or offset checks. Samsung's September 2026 bulletin resolves the defect in SMR Sep-2026 Release 1.

Attack Vector

Exploitation requires local access and high privileges on the device. An attacker must already control a component authorized to issue commands to the Keymaster trustlet, such as a compromised system service or a privileged Android process. Remote exploitation is not possible without a prior foothold. No user interaction is required once the attacker holds the necessary privileges.

Refer to the Samsung Security Update September 2026 advisory for vendor-published details.

Detection Methods for CVE-2026-21085

Indicators of Compromise

Unexpected Keymaster trustlet crashes, resets, or tzdaemon errors recorded in device logs
Anomalous invocations of Keymaster APIs from processes that do not normally interact with hardware-backed keystore operations
Attestation failures or unexpected key blob invalidation events

Detection Strategies

Monitor mobile device management (MDM) telemetry for firmware build strings older than SMR Sep-2026 Release 1
Alert on privileged process behavior that abuses IKeymasterDevice or related HAL interfaces at abnormal rates
Correlate application crash dumps referencing Keymaster with concurrent privilege escalation indicators

Monitoring Recommendations

Enforce MDM compliance policies that report the current Samsung security patch level
Ingest mobile endpoint telemetry into a centralized data lake for cross-device correlation
Track TEE-related kernel messages and TrustZone logs for repeated fault patterns

How to Mitigate CVE-2026-21085

Immediate Actions Required

Install SMR Sep-2026 Release 1 or later on all affected Samsung devices
Inventory devices missing the September 2026 patch level using MDM reporting
Restrict installation of untrusted applications that could be leveraged to gain privileged local access

Patch Information

Samsung addressed CVE-2026-21085 in the September 2026 Security Maintenance Release. Administrators should confirm devices report a security patch level of 2026-09-01 or later. Full details are published in the Samsung Security Update September 2026 bulletin.

Workarounds

No vendor-supplied workaround is available; patching is the required remediation
Limit device exposure by enforcing least-privilege application policies until updates are deployed
Revoke and reissue hardware-backed attestation keys on any device suspected of compromise after patching

bash

# Verify Samsung security patch level via adb
adb shell getprop ro.build.version.security_patch
# Expected output: 2026-09-01 or later