GhostLock Exploitation Failure Summary on PD2229 (SM8475, 5.10.233 GKI)

I. Vulnerability and Device Facts

1.1 CVE-2026-43499 (GhostLock) Basic Information

Item	Value
Vulnerability Type	Stack Use-After-Free in the rt_mutex / futex PI path
Introduced Version	Linux 2.6.39-rc1 (May 2011, commit 8161239a8bcc)
Fixed Version	mainline 7.1 (commit 3bfdc63936dd), stable branches: 6.1.175 / 6.6.140 / 6.12.86 / 6.18.27 / 7.0.4
Prerequisite	CONFIG_FUTEX_PI=y (enabled by default in mainstream kernels)
CVSS	7.8 High
Exploit Stability	NebuSec original chain 97%, root in ~5 seconds
kernelCTF Bounty	$92,337 USD

Affected kernel ranges:

• 2.6.39 ≤ Linux < 6.1.175 ✅ Affected
• 6.2 ≤ Linux < 6.6.140 ✅ Affected
• 6.7 ≤ Linux < 6.12.86 ✅ Affected
• 6.13 ≤ Linux < 6.18.27 ✅ Affected
• 6.19 ≤ Linux < 7.0.4 ✅ Affected
• Android GKI 5.10 is in none of the fix branches → PD2229's 5.10.233 is theoretically affected

1.2 PD2229 Device Measurements

Item	Value
SoC	Qualcomm SM8475 (Snapdragon 8 Gen 1 Plus)
Kernel Version	5.10.233-gki-g6e61de9f5b58 #1 SMP PREEMPT (Nov 24 2025)
Android Version	15 (OriginOS 5)
Build Date	2025/11/25
Android Security Patch	2025/11/01
CONFIG_FUTEX_PI	y ✅
CONFIG_UNMAP_KERNEL_AT_EL0	y (KPTI enabled)
kptr_restrict	enforced
CONFIG_IO_URING	y ✅ (confirmed via vmlinux symbols, and seccomp does not intercept io_uring_setup)

---

II. Ideal Exploit Chain vs Actual PD2229 Progress

2.1 NebuSec Original Chain (successful on x86_64 / Pixel 10)

1. KASLR 绕过        → prefetch timing / PR_SET_MM_MAP auxv
2. UAF 触发          → 三线程 PI 依赖死锁 → FUTEX_CMP_REQUEUE_PI 返回 -EDEADLK
3. 栈回收            → PR_SET_MM_MAP 将 auxv 拷贝到 waiter 栈帧
4. rb_erase 受限写   → 覆写 inet6_protos[IPPROTO_UDP]
5. CEA + ROP         → 控制流劫持
6. core_pattern 翻转 → root shell (97% 成功率)

2.2 Actual PD2229 Progress by Stage

Stage	Status	Description
1. KASLR Bypass	✅ Implemented	perf_event_open + callchain sampling side channel (same method as the OPPO Find X6 Pro 5.15.149 adaptation)
2. UAF Trigger	✅ Implemented	Three-thread PI deadlock succeeds, FUTEX_CMP_REQUEUE_PI returns -EDEADLK
3. Stack Reclaim Primitive	❌ Architectural failure	Stack frames of all known syscalls do not overlap the waiter (see Section III)
4. rb_erase Constrained Write	❌ Blocked	Prerequisite not met
5. inet6_protos Overwrite	❌ Not started	Depends on stage 4
6. ROP / Control Flow Hijack	❌ Not started	Depends on stage 5
7. Root Shell	❌ Not started	Depends on stage 6

---

III. Stack Reclaim Primitive Exhaustive Search Results (PD2229 Measured)

3.1 Key Stack Frame Layout Calculations

futex 路径总深度:
  __arm64_sys_futex    0x90
  + do_futex           0xc0
  + futex_wait_requeue_pi  0x1b0
  = 0x300
waiter 位置 = SYS_SP - 0x300 + 0x20 = SYS_SP - 0x2e0

pselect 路径:
  core_sys_select 栈帧 0x1c0, stack_fds 在 sp+0x50
  覆盖区间: SYS_SP - 0x1c0 + 0x50 = SYS_SP - 0x170 起
  与 waiter (SYS_SP - 0x2e0) 差距 0x170 (368 字节) → 不重叠

3.2 17 Stack Write Methods Attempted

#	Method	Syscall	PD2229 Result	Core Failure Reason
1	stamp_prctl	PR_SET_MM_MAP	❌ EPERM	Android hard block
2	stamp_pselect	pselect6 (NFDS=320)	❌ No overlap	waiter is 120B below fd_set
3	stamp_pselect	pselect6 (NFDS>336)	❌ Heap allocation	kvmalloc path
4	stamp_socket	MCAST_JOIN_SOURCE_GROUP	❌ Insufficient overwrite	Only writes the lock field
5	stamp_sendmsg	sendmsg	❌ 80B from waiter	Stack frame 0x90 too shallow
6	stamp_sendmmsg	sendmmsg	❌ 112B from waiter	Insufficient stack frame
7	stamp_recvmmsg	recvmmsg	❌ Zeroes task/lock	0x1d0 stack frame corrupts key pointers
8	stamp_process_vm	process_vm_writev	❌ No overlap	Child thread stack allocated separately
9	stamp_keyctl	KEYCTL_INSTANTIATE_IOV	❌ EOPNOTSUPP	Syscall unsupported + stack frame 0x40
10	stamp_tcp	TCP_ZEROCOPY_RECEIVE	❌ Insufficient stack frame	Estimated depth not enough
11	stamp_futex	FUTEX_CMP_REQUEUE_PI recursion	❌ Logically infeasible	Corrupts the UAF window
12	binder ioctl	BINDER_WRITE_READ	❌ EACCES	shell lacks /dev/binder permission
13	poll	poll	❌ Heap allocation	pollfd is on the heap
14	epoll_wait	epoll_wait	❌ Frame too shallow	Stack frame 0xE0
15	sched_setattr	sched_setattr	❌ Insufficient depth	Stack frame 0xb0
16	timerfd_settime	timerfd_settime	❌ No stack copy	No large stack buffer
17	io_uring_register	IORING_REGISTER_*	❌ Double failure	①Stack frame is only 0xF0, and the copy_from_user target is fixed at sp+0x8 (424 bytes away from the waiter's sp+0x1D0); ②although io_uring_setup is not intercepted by seccomp (returns EFAULT instead of ENOSYS), the stack layout does not match

17/17 all failed.

3.3 Root Cause of Failure

The stack layout produced by PD2229's SM8475 5.10 GKI compiler (PGO + LTO + BOLT) causes core_sys_select's stack_fds and futex_wait_requeue_pi's rt_mutex_waiter to be architecturally non-overlapping. This is an objective fact determined by the compiler, not an exploit technique issue.

The JoinChang repository explicitly states: "The pselect stack overlay only works when the freed rt_mutex_waiter lands within the user-controllable region of the stack_fds buffer" — PD2229 does not satisfy this condition.

---

IV. Public Reference Repository Comparative Analysis

NebuSec/CyberMeowfia — Original Exploit Framework

• Repository: https://github.com/NebuSec/CyberMeowfia
• Target: x86_64 Linux / Pixel 10 (6.x GKI)
• Stack Reclaim: PR_SET_MM_MAP copies auxv to the kernel stack
• Success Rate: 97%, root [shell] in ~5 seconds
• PD2229 Applicability: ❌ PR_SET_MM_MAP is blocked by EPERM on Android

JoinChang/ghostlock-oneplus — OnePlus locked-BL jailbreak

• Repository: https://github.com/JoinChang/ghostlock-oneplus
• Verified Devices:
  • OnePlus Ace 6T (PLR110, SM8845) — 6.12.38 GKI ✅
  • OnePlus 15 (PLK110, SM8845) — 6.12.23 GKI ✅
• Technical Highlights:
  • Offset auto-extraction: kallsyms (28) + BTF (57) + derived (9) + constants (12) = 103/103
  • pselect stack overwrite, SP diff = -64
  • PSELECT_SHIFT = -2
  • Exploit chain: futex UAF → forge waiter → pselect controls the stack → rb_erase constrained write → selinux_state.enforcing=0 → overwrite cred with init_cred
• Explicitly declared infeasible: "Not Feasible (stack layout incompatible)" — only applies to kernels where pselect stack_fds overlaps the waiter
• PD2229 Applicability: ❌ Kernel generation mismatch (6.12 vs 5.10), and stack layouts do not overlap

p2p3p/GhostLock-for-OnePlus — Complete OnePlus 6.12 Exploit

• Repository: https://github.com/p2p3p/GhostLock-for-OnePlus
• Verified: OnePlus Ace 6T (SM8845, 6.12.38) ✅
• PD2229 Applicability: ❌ Same as JoinChang, kernel generation mismatch

YuKongA/ghostlock-oplus — OPPO Find N5/X8

• Repository: https://github.com/YuKongA/ghostlock-oplus
• Kernel: 6.6.118 GKI
• PD2229 Applicability: ❌ Kernel generation mismatch

OPPO Find X6 Pro (PGEM10) Adaptation — 5.15.149

• Device: SM8550, 5.15.149-android13, Android 15
• Progress: ✅ KASLR bypass (perf_event_open + callchain sampling); later stages not publicly disclosed as a complete exploit
• Significance: Proves KASLR bypass is feasible on 5.15 GKI, but the stack reclaim stage has not been publicly verified