CVE-2026-20974: 
NixOS vulnerability analysis and mitigation

CVE-2026-20974 is an improper input validation vulnerability in Samsung Android's network restriction data handling that allows physical attackers to bypass Carrier Relock protections. It was published on January 9, 2026, and affects Samsung Android versions 13, 14, 15, and 16 prior to the SMR Jan-2026 Release 1 security update. The vulnerability carries a CVSS v3.1 base score of 4.6 (Medium) and a CVSS v4.0 base score of 5.2 (Medium) (Samsung Advisory).

The root cause is improper input validation (CWE-20) in data related to network restrictions on Samsung Android devices. An attacker with physical access to the device can supply maliciously crafted input to the network restriction data handling component, bypassing the Carrier Relock mechanism — a security feature that prevents unauthorized changes to carrier-specific network configurations. No authentication or user interaction is required, but physical device access is a prerequisite for exploitation. No public technical write-ups or proof-of-concept code have been identified (Samsung Advisory).

Successful exploitation allows a physical attacker to bypass Carrier Relock protections, enabling unauthorized modification of carrier settings and network configurations on affected Samsung devices. The primary impact is to integrity — an attacker could alter network restriction data to unlock a device from its designated carrier, potentially enabling use on unauthorized networks or circumventing carrier-enforced controls. There is no confidentiality or availability impact reported, and the scope is limited to the affected device itself with no lateral movement potential (Samsung Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.044%, reflecting a very low probability of exploitation in the near term. Physical access to the target device is required, which significantly limits the attacker pool (Samsung Advisory).

Samsung has addressed this vulnerability in the SMR Jan-2026 Release 1 security update, available for affected Samsung Android devices running versions 13, 14, 15, and 16. Users and administrators should apply the January 2026 Samsung security patch immediately via the device's Software Update menu (Settings > Software Update). As a compensating control during the patching window, physically securing devices to prevent unauthorized access is recommended. No configuration-based workaround is available (Samsung Advisory).

Coverage of CVE-2026-20974 has been limited to routine security patch aggregation sites and threat intelligence feeds, with no notable independent researcher commentary or significant media coverage identified. The vulnerability was included in Samsung's January 2026 monthly security bulletin alongside approximately 55 other fixes (Samsung Advisory).