GhostLock Sabrina

Root exploit for Chromecast with Google TV (sabrina) via CVE-2026-43499 -- a use-after-free in the Linux kernel's futex PI (priority inheritance) subsystem.

Achieves root on a locked bootloader device running Android 14 with kernel 5.15.170 (PGO+BOLT+LTO, clang 17).

The vulnerability

GhostLock exploits a bug in remove_waiter() called from the -EDEADLK rollback path in rt_mutex_start_proxy_lock(). The function clears current->pi_blocked_on (the requeuer's, already NULL) instead of the waiter task's. The waiter's pi_blocked_on is never cleared, leaving a dangling pointer to a freed rt_mutex_waiter on the kernel stack.

A subsequent sched_setattr triggers rt_mutex_adjust_pi -> rt_mutex_adjust_prio_chain, which follows the dangling pointer and walks a PI chain over attacker-controlled data on a reclaimed heap page -- giving an arbitrary write primitive via rb_erase.

Exploit chain

Key innovations

• SIGUSR1 walk-before-cleanup: the SEQPACKET overlay runs inside a signal handler that interrupts the futex wait, so the PI chain walks fire before the futex cleanup path can contend the spray page's spinlocks (eliminates the MCS qspinlock wedge)
• Fake user_namespace: a self-contained namespace on the spray page with identity uid/gid maps and ucounts = NULL -- cap_capable matches on the first iteration and inc_rlimit_ucounts terminates after one loop, eliminating the need to leak &init_user_ns
• TID-gated perf sampling: PERF_SAMPLE_TID filters ensure only the calling thread's register snapshots are counted, preventing hot system services from dominating the mode-vote

Target

• Device: Chromecast with Google TV (sabrina), Amlogic S905X3 (4x A55), 2 GB RAM
• Kernel: 5.15.170-android14-11-gf4a1f03072af (aarch64, PGO+BOLT+LTO, clang 17.0.2)
• Android: 14, build UTTC.250917.004, security patch 2025-10-01
• Config: CONFIG_FUTEX_PI=y, CONFIG_IO_URING=y, perf_event_paranoid=-1, SELinux enforcing, panic_on_oops=1, no user namespaces

Building

export ANDROID_NDK_HOME=/path/to/android-ndk
make -j$(nproc)

Requires the Android NDK (tested with r27). Produces a statically linked aarch64 binary.

Usage

adb push ghostlock /data/local/tmp/
adb shell "cd /data/local/tmp && ./ghostlock --cred"

The exploit takes ~20 seconds (heap spray + KernelSnitch bruteforce). On success, the process exec's /system/bin/sh with uid=0 credentials.

Authorship

This exploit was ported and developed by Claude Opus 4.6 (Anthropic) with GLM-5.3 (Z.ai) as kernel exploitation consultant.

References

• GhostLock (original exploit) -- the OnePlus/Pixel GhostLock exploit by AnomalyStudio that this port is based on
• KernelSnitch -- timing side-channel for leaking kernel heap addresses via futex hash collisions (Gruss et al., TU Graz)
• CVE-2026-43499 -- the futex PI use-after-free vulnerability
• Linux kernel 5.15 source -- kernel/futex/, kernel/locking/rtmutex.c, lib/rbtree.c

Disclaimer

This exploit is published for security research and educational purposes. It targets a device owned by the researcher. Do not use this on devices you do not own or without authorization.

License

MIT