camsshaft/ionstack-s22-cve-2026-43499Android kernel exploit for Samsung Galaxy S22 that gains kernel-domain root via CVE-2026-43499, with SELinux permissive, device-specific kallsyms, and panic logging.
Full root in the kernel domain with selinux permissive on my SM-S901W S22 5.10.168-android12-9-27760517-abS901WVLS4DWL3.
I'm not going into great detail or lengths in this one since there's like 5,000 other repos out there and, as I've learned, almost each of these variations of the same exploit are unique to the device they're tailored to and I'm tired of filling these out. Mine in particular came from this talented gentleman here and all credit goes to him for this method https://github.com/sarabpal-dev/IonStack-S22U I'll show exactly why an extensive write-up is pointless and all the information included is sufficient enough as a template. Below is the device sarabpal-dev used and below that is mine
Device: Samsung Galaxy S22 Ultra (SM-S908W)
Codename: b0q
Android: 15 / SDK 35
Build number: AP3A.240905.015.A2.S908WVLS8FYG7
Build display ID: AP3A.240905.015.A2.S908WVLS8FYG7
Build fingerprint: samsung/b0qcsx/b0q:15/AP3A.240905.015.A2/S908WVLS8FYG7:user/release-keys
Kernel: 5.10.226-android12-9-30958166-abS908WVLS8FYG7
Architecture: aarch64
Device: Samsung Galaxy S22 (SM-S901W)
Codename: r0q
Android: 14 / SDK 34
Build number: UP1A.231005.007.S901WVLS4DWL3
Build display ID: UP1A.231005.007.S901WVLS4DWL3
Build fingerprint: samsung/r0qcsx/r0q:14/UP1A.231005.007/S901WVLS4DWL3:user/release-keys
Kernel: 5.10.168-android12-9-27760517-abS901WVLS4DWL3
Architecture: aarch64
So as you can see they are very similar but there is a very big difference between them. His version uses an executable built entirely in 32 bit while for mine I had to change it into 64 bit while still being compatible with the rest of the code. It took quite a lot of disassembling amongst other things to verify if it was even a valid exploitable route to use. Thankfully it was, but I will make no guarantees for anyone else. I hope it's still a good method lots of people can use but that's up to you guys to figure out. The readme's and some comments might be out of scope for this device but the code is accurate so thats what mattered for me
P.S. what you need is the android-ndk in termux and your exact firmware versions boot.img to extract the kernel and kallsyms. I added logging so it saves a file to /sdcard/cve-2026-43499.log so in case it panics you at least have some info to work off of if you dont know how to find the relevant information after a reboot (shouldn't be doing this if thats the case but that's neither here nor there).