EIP-2026-100030

PRE-CVE

Google Android - RKP Information Disclosure via s2-remapping Physical Ranges

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-100030. PoCs published by Google Security Research.

AI-analyzed exploit summary This exploit leverages a vulnerability in Samsung RKP (Real-time Kernel Protection) where the 'rkp_set_init_page_ro' command fails to validate physical address ranges, allowing an attacker to remap and read protected memory regions from EL1. The PoC demonstrates remapping RKP's physical address range and reading its contents.

Description

Google Android - RKP Information Disclosure via s2-remapping Physical Ranges

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdosandroid
https://www.exploit-db.com/exploits/41218

This exploit leverages a vulnerability in Samsung RKP (Real-time Kernel Protection) where the 'rkp_set_init_page_ro' command fails to validate physical address ranges, allowing an attacker to remap and read protected memory regions from EL1. The PoC demonstrates remapping RKP's physical address range and reading its contents.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Samsung RKP (Real-time Kernel Protection) version RKP4.2_CL7572479 on Samsung SM-G935F devices
No auth needed
Prerequisites: Physical or privileged access to a vulnerable Samsung device with RKP enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026