PS7716.5665N Hazel Fire TV temporary root

Temporary root exploit for the Toshiba/Amazon hazel Fire TV platform, based on CVE-2026-43499.

The current exploit is tested on:

[!WARNING] This exploit is firmware-specific. Kernel addresses, structure offsets, and parts of the reclaim chain are calibrated for PS7716.5665N.

Do not run the current build on a different firmware or device without porting/recalibrating it first.

A failed heap reclaim may panic and reboot the TV. Root is temporary and is lost after reboot. If your TV freezes, you can always power cycle it.

What it does

The exploit uses CVE-2026-43499 to obtain temporary UID 0 from the normal ADB shell environment.

The exploit chain includes:

• ARM32 futex-PI UAF exploitation
• kernel address leak
• mm_struct cross-cache reclaim
• controlled kernel object reclaim
• kernel read/write primitives
• current task discovery
• credential patching
• a local root command server/client

After a successful run, the exploit keeps the kernel objects required by the root path alive and starts a local command daemon.

SELinux remains Enforcing. Commands executed through the root daemon retain the shell SELinux domain and the capability bounding set available on this firmware.

Files

• hazel_root.c main exploit, kernel read/write stage, credential patching, and root command client/server
• hazel_reclaim.h kernel address leak and mm_struct cross-cache reclaim

Requirements

• ADB
• Android NDK r27d
• ADB debugging enabled on the TV
• a host capable of building an ARMv7 Android executable

The examples below assume Linux and that adb is available in $PATH.

Build (optional)

Set NDK to your Android NDK r27d directory:

export NDK=/path/to/android-ndk-r27d

Then compile:

"$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang" \
    --target=armv7a-linux-androideabi28 \
    -O2 -g0 -Wall -Wextra -Wpedantic -fPIE -pie \
    hazel_root.c -o hazel_root \
    -pthread

Install

Connect to the TV using ADB.

If using network ADB:

adb connect <TV_IP>:5555

Push the exploit:

adb push hazel_root /data/local/tmp/hazel_root
adb shell chmod 755 /data/local/tmp/hazel_root

Run

Start from a clean boot:

adb shell 'cd /data/local/tmp && ./hazel_root'

A successful run ends with output similar to:

[root] uid=0 euid=0 gid=0
[ROOT] uid=0 daemon pid=... socket=@hazel_root

The reclaim is probabilistic. An unsuccessful attempt may fail cleanly or panic and reboot the TV.

If the TV reboots, let it boot normally and try again.

Once the exploit succeeds, do not launch another copy. Leave the exploit processes running, as they retain kernel objects used by the temporary root path.

Run commands as root

The same binary acts as a client for the root daemon:

adb shell 'cd /data/local/tmp && ./hazel_root --client id'

For example:

adb shell 'cd /data/local/tmp && ./hazel_root --client getenforce'
adb shell 'cd /data/local/tmp && ./hazel_root --client cat /proc/self/status'
adb shell 'cd /data/local/tmp && ./hazel_root --client "id; uname -a"'

A successful root command should report:

uid=0(root) gid=0(root) context=u:r:shell:s0

Note that UID 0 does not bypass SELinux. SELinux remains Enforcing.

Disable OTA updates

Push and run disable_ota.sh through the root daemon:

adb push disable_ota.sh /data/local/tmp/disable_ota.sh
adb shell chmod 755 /data/local/tmp/disable_ota.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_ota.sh"'

The script disables both Fire OS OTA packages, clears pending updater state, and verifies the resulting Package Manager state. It does not reboot the TV.

Disable Amazon package enforcement, ACR, and metrics

disable_amazon_services.sh disables the Arcus remote-configuration proxy, the ADEP application-blocking service, Automatic Content Recognition (ACR), and the dedicated Amazon metrics packages present on the tested Hazel firmware. ACR is disabled and its stored data is cleared, but its read-only system APK is not deleted, making the operation reversible. The script does not disable CrashManager or the low-level logging packages, so kernel panic and Dropbox diagnostics remain available while developing or troubleshooting the exploit.

Push the script and run it through the root daemon:

adb push disable_amazon_services.sh /data/local/tmp/disable_amazon_services.sh
adb shell chmod 755 /data/local/tmp/disable_amazon_services.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_amazon_services.sh"'

Show the current state without changing anything:

adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_amazon_services.sh status"'

Restore the packages later if required:

adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_amazon_services.sh restore"'

The enabled or disabled package state normally survives a reboot. Restoring the packages does not restore the package data cleared while disabling them.

Recovery

Reboot the TV:

adb reboot

The exploit only modifies temporary kernel state, so root is lost after reboot.

Changes deliberately made to persistent Android settings or data while root was active are, of course, not necessarily reverted by rebooting.

Compatibility

The only currently confirmed target is:

hazel
PS7716.5665N
Linux 4.9.113
ARM32

Other TVs also appear to use the hazel device name, but sharing the codename does not mean they share the same kernel build, board, or structure layout.

Do not assume compatibility with another hazel device.

If you are interested in porting the exploit, useful target information includes:

adb shell getprop ro.product.model
adb shell getprop ro.product.device
adb shell getprop ro.product.board
adb shell getprop ro.build.version.incremental
adb shell uname -a

The hardcoded kernel addresses and structure offsets in the current source must be verified for each target firmware.

Technical notes

This is a firmware-specific adaptation of the CVE-2026-43499 exploit chain for the vendor ARM32 Linux 4.9 kernel used by this Fire OS build.

The Hazel-specific work includes:

• adapting the futex-PI chain to the target kernel
• kernel address discovery
• mm_struct SLUB/cache shaping
• cross-cache reclaim using AF_UNIX allocations
• target-specific object and waiter layouts
• forged file operations
• configfs-backed kernel read/write
• task discovery and credential modification

The current exploit therefore should not be treated as a generic CVE-2026-43499 PoC or as a drop-in exploit for arbitrary Fire TV firmware.

Credits

This port was developed by studying and adapting ideas from the following public CVE-2026-43499 exploit implementations:

• gitchw/ghostlock-cve-2026-43499 ARM32 futex-PI UAF reference and waiter/owner/consumer chain.

• NebuSec/CyberMeowfia IonStack exploit, including the broader forged-fops, kernel read/write, and credential-patching design.

• F-19-F/IonStackQuest3 ARM32 setsockopt(MCAST_JOIN_SOURCE_GROUP) stack-stamping and synchronization reference.

• R0rt1z2/GhostLock-5.10 Additional ARM32 layouts and exploit techniques used while cross-checking the Hazel port.

AI disclosure

An AI coding agent was used during development, particularly to help analyze crash and disassembly data, locate and cross-check target-specific kernel addresses and structure offsets, and assist with debugging and code cleanup.

The exploit itself was tested on the target PS7716.5665N device, and the target-specific values used by the released build were validated against that firmware. AI output was treated as a research aid rather than a source of truth.