Samsung FabricKeymaster Trustlet Time-of-Check Time-of-Use Race Condition Vulnerability Allowing Arbitrary Code Execution

A time-of-check time-of-use race condition has been identified in the fabricKeymaster trustlet, affecting Samsung devices running Android versions 14, 15, and 16, prior to the July 2026 Security Maintenance Release. This vulnerability allows local privileged attackers to execute arbitrary code by exploiting the timing of checks and usage in the trustlet.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code within the context of the trustlet.

Remediation

Users can apply the July 2026 Security Maintenance Release to address this vulnerability. This update is part of the monthly security update process and includes patches from both Google and Samsung.