CVE-2026-43499 (GhostLock) — CVE-2026-43499 Vulnerability Adaptation Research Archive

Device: OPPO PKP110 (OP5DF3) · Kernel 6.1.134-android14-11-o · Android 16 (SDK 36) Research period: 2026-08-20 ~ 2026-08-22

Final Conclusion

CVE-2026-43499 exploitation chain cannot converge on 6.1 GKI + Android 14/15/16 hardened environments.

Root cause of failure: PI chain does not traverse the sprayed page (independently verified by iQOO Neo9s PRO research)

• The rt_mutex_waiter created by futex_wait_requeue_pi resides on the kernel stack
• pi_blocked_on points to an rt_mutex allocated inside the kernel
• The fake waiter/lock sprayed by KernelSnitch does not participate in PI chain traversal
• As a result, rb_erase cannot write to attacker-controlled targets (boot_id, etc.)

Adaptation Results

All three KASLR leak routes are blocked, and the privilege escalation chain cannot converge.

File Description

Modification Log

generate_target.py (6 modifications)

• locate_markers: full-range fallback search
• locate_u32_offset_table: fallback search
• BTF same-name types: strict equivalence → select first
• rt_waiter_node → direct rt_mutex_waiter fields
• futex stack frame validation skipped
• FAKE_WAITER_* hardcoded tokay verified values

slide.c (3 modifications)

• open_slide_selected_fds: skip fds 0-2 (avoid dup2 overwriting stdout)
• Added pr_dbg_file synchronous disk write
• sched_setattr_tid: added setpriority route (bypass SELinux)

target.h

• All offsets replaced with OPPO BTF-verified values

References

Independent research on iQOO Neo9s PRO / iQOO Z10x / vivo X Fold5 all reached the same conclusion.

Future Directions

• Vendor proprietary driver vulnerabilities (GPU/ISP/VPU)
• CVE-2026-64560 (requires heap feng shui + KASLR)
• Await publicly disclosed new CVEs after 2026-03

---

Archived on 2026-08-22 · 52MB complete research package available in Release