Lior Keshet

**Name of the Vulnerable Software and Affected Versions** DualDAR versions prior to SMR Jan-2026 Release 1 **Description** A use after free condition exists in DualDAR prior to SMR Jan-2026 Release 1, potentially allowing a local privileged attacker to execute arbitrary code. **Recommendations** Update to SMR Jan-2026 Release 1 or later.

**Name of the Vulnerable Software and Affected Versions** Samsung KNOX versions prior to SMR Jan-2026 Release 1 **Description** A use-after-free race condition exists in the PROCA (process authenticator) kernel driver, a proprietary subsystem designed to prevent unauthorized process execution. The issue occurs during the interaction between PROCA and FIVE (a kernel-side integrity verification subsystem). Specifically, when a process creates a child process and calls `execve()`, the `task integrity put(old tint)` function releases the original security state structure. Due to the preemptive nature of the Android kernel, a thread may be suspended between reading a pointer and using it, allowing `proc integrity value read()` to resume and call `task integrity user read()` using a pointer to memory that has already been freed. This flaw can be triggered by an untrusted application to read freed memory before the FIVE subsystem clears it, potentially leading to kernel memory corruption and arbitrary code execution. **Recommendations** Update to the January 2026 SMR update.