CVE-2026-43499 Detector

Android app that detects the kernel vulnerability CVE-2026-43499 — a use-after-free in rtmutex triggered via futex_requeue.

Vulnerability

How it works

1. Checks kernel version against known-patched releases. If the kernel is at or above a patched version, reports safe immediately.
2. Otherwise, runs a native PoC binary (shipped via jniLibs, executed from nativeLibraryDir).
3. For 5 attempts:
   • Starts the binary
   • Waits 5 seconds
   • Sends SIGTERM
   • Waits 5 seconds for the process to die
4. If the process survives SIGTERM in any attempt (stuck in D-state) → vulnerable.
5. If all 5 attempts are killable → patched.
6. Waits an additional 5 seconds after the last attempt.

Binary bitness is auto-detected from Build.SUPPORTED_ABIS.

Requirements

• Android 7.0+ (API 24)
• ARM (32-bit build: armeabi-v7a)

Tech stack

• Kotlin
• Jetpack Compose
• Material Deisgn 3
• Single-activity architecture

Build

./gradlew assembleDebug

APK output: app/build/outputs/apk/debug/app-debug.apk

Links

• CVE-2026-43499 (NVD)
• PoC source code

Kernel patches

Warning

Running the test on a vulnerable device may cause a kernel crash or spontaneous reboot. Proceed at your own risk.