CVE-2026-21123: Samsung Locksettings vulnerability

Q: Who can exploit this issue?

Exploitation requires local access and root privilege. The issue affects access to data belonging to a tied profile before the device's first unlock.

Q: What condition makes the tied-profile data exposed?

The exposure exists in the period before first unlock. An attacker must already have root privilege locally to access the tied profile's data during that state.

Q: What should be done to remediate the issue?

Update Samsung Locksettings to the SMR Oct-2026 Release 1 or later remediation provided by Samsung.

Published Oct 12, 2026

Updated

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.

Affected Software

1 affected component

Samsung Locksettings<SMR Oct-2026 Release 1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Locksettings to a version that resolves this vulnerability.
Patch SMR Oct-2026 Release 1

Event History

Oct 12, 2026

CVE Published

via MITRE·04:57 AM

Data Sourced

via MITRE·04:57 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires local access and root privilege. The issue affects access to data belonging to a tied profile before the device's first unlock.

What condition makes the tied-profile data exposed?

The exposure exists in the period before first unlock. An attacker must already have root privilege locally to access the tied profile's data during that state.

What should be done to remediate the issue?

Update Samsung Locksettings to the SMR Oct-2026 Release 1 or later remediation provided by Samsung.

CVE-2026-21123: Samsung Locksettings vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What condition makes the tied-profile data exposed?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What condition makes the tied-profile data exposed?

What should be done to remediate the issue?