CVE-2026-21123: Medium severity Samsung Locksettings vulnerability
Published Oct 12, 2026
·Updated
Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.
Affected Software
1 affected component
Samsung Locksettings<SMR Oct-2026 Release 1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Locksettingsto a version that resolves this vulnerability.Patch SMR Oct-2026 Release 1
Event History
Oct 12, 2026
CVE Published
via MITRE·04:57 AM
Data Sourced
via MITRE·04:57 AM
DescriptionWeakness
Data Sourced
via NVD·05:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Exploitation requires local access and root privilege. The issue affects access to data belonging to a tied profile before the device's first unlock.
2
What condition makes the tied-profile data exposed?
The exposure exists in the period before first unlock. An attacker must already have root privilege locally to access the tied profile's data during that state.
3
What should be done to remediate the issue?
Update Samsung Locksettings to the SMR Oct-2026 Release 1 or later remediation provided by Samsung.