CVE-2026-21123 Overview
CVE-2026-21123 is an improper privilege management vulnerability in the Samsung Locksettings component. The flaw affects Samsung mobile devices prior to the Security Maintenance Release (SMR) October 2026 Release 1. A local attacker holding root privileges can access data belonging to a tied profile before the device reaches its first unlock (BFU) state. The weakness is tracked under CWE-269: Improper Privilege Management and resides in the subsystem that enforces lock-screen credential boundaries between user profiles.
Critical Impact
A root-privileged local attacker can read confidential data from a tied secondary profile before first unlock, breaking the cryptographic isolation that Android enforces on protected user storage.
Affected Products
- Samsung mobile devices running affected Android builds prior to SMR Oct-2026 Release 1
- Samsung Locksettings service component
- Secondary (tied) user profiles on affected Samsung firmware
Discovery Timeline
- 2026-10-12 - CVE-2026-21123 published to the National Vulnerability Database
- 2026-10-16 - Last updated in NVD database
- October 2026 - Samsung addresses the issue in the SMR Oct-2026 Release 1 bulletin
Technical Details for CVE-2026-21123
Vulnerability Analysis
The vulnerability resides in Samsung's Locksettings service, which manages lock-screen credentials and the keys that gate access to protected profile storage. Android maintains two primary user data states: Before First Unlock (BFU) and After First Unlock (AFU). In the BFU state, Credential Encrypted (CE) storage for a user should remain cryptographically sealed until the owner enters their credential.
For tied profiles, such as work profiles that inherit or are bound to the parent user credential, Locksettings is responsible for enforcing that keys are not released until the parent profile authenticates. The flaw allows a caller already holding root to bypass this enforcement and reach data in the tied profile while the device is still in the BFU state.
Because exploitation requires root, the vulnerability is a privilege-management defect rather than a remote compromise vector. It is relevant in post-exploitation chains, forensic acquisition scenarios, and compromised update or recovery contexts.
Root Cause
The root cause is improper privilege management in Locksettings [CWE-269]. The component fails to adequately scope credential handling for tied profiles, permitting a root process to access protected profile data without the required unlock event. The expected security boundary — that CE-protected profile data remains inaccessible before first unlock — is not consistently enforced.
Attack Vector
The attack vector is local and requires high privileges (root) on the device. No user interaction is required. An attacker who has obtained root through a prior vulnerability, a malicious recovery image, or physical acquisition can query Locksettings to reach data belonging to a tied profile before the user has authenticated. The impact is limited to confidentiality of the tied profile; integrity and availability are not affected.
No verified exploit code or public proof-of-concept is available. See the Samsung Mobile Security Update for vendor technical details.
Detection Methods for CVE-2026-21123
Indicators of Compromise
- Unexpected root-level processes invoking Locksettings or related keystore interfaces while the device is in a Before First Unlock state.
- Access to Credential Encrypted (CE) storage paths for tied or work profiles prior to a successful user unlock event.
- Presence of unauthorized su, Magisk, or custom recovery artifacts on managed Samsung devices.
Detection Strategies
- Mobile Device Management (MDM) attestation checks for Samsung Knox and Verified Boot status to flag rooted or tampered devices.
- Review Samsung Knox audit logs for anomalous Locksettings service calls originating from non-system UIDs.
- Correlate device boot events with profile data access timestamps to identify reads that occur before the first unlock.
Monitoring Recommendations
- Enroll Samsung devices in an MDM that enforces Knox attestation and blocks access to corporate resources from devices failing integrity checks.
- Alert on firmware builds older than SMR Oct-2026 Release 1 across the managed fleet.
- Monitor for repeated reboots followed by rapid profile data access, a pattern consistent with offline acquisition attempts.
How to Mitigate CVE-2026-21123
Immediate Actions Required
- Apply the Samsung SMR Oct-2026 Release 1 update to all affected devices as soon as the OEM delivers it to the device model.
- Enforce MDM policies that quarantine rooted or non-attested Samsung devices from corporate work profiles.
- Audit device inventory for firmware older than the October 2026 patch level and prioritize remediation on devices handling sensitive tied-profile data.
Patch Information
Samsung addresses CVE-2026-21123 in the SMR Oct-2026 Release 1 security maintenance release. Patch availability varies by device model and carrier. Refer to the Samsung Mobile Security Update bulletin for the authoritative list of patched builds and device models.
Workarounds
- Prevent device rooting by enforcing bootloader lock and Verified Boot through enterprise MDM policy.
- Disable or avoid provisioning tied secondary profiles on unpatched devices that store sensitive corporate data.
- Require full-device encryption and strong lock-screen credentials to maximize the protection provided by the BFU state.
- Restrict physical access to high-value devices to reduce opportunity for offline root-level acquisition.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
