EIP-2026-100056

The writeup details a vulnerability in Samsung KNOX's RKP hypervisor where certain memory regions are incorrectly marked as RWX in both stage 1 and stage 2 translation tables, allowing arbitrary code execution in EL1. The issue arises due to mismatched protection ranges between the kernel text region and the broader reserved physical address range.