meowkis/tcp-zerocopy-smghostlock + tcp-zerocopy hybrid CVE-2026-43499 adaptation for samsung kernel
| Property | Value |
|---|---|
| Device | Samsung Galaxy S23 Ultra, dm3q / SM-S918B |
| Build | S918BXXSAFZF5 |
| Android version | 16 |
| Fingerprint | samsung/dm3qxxx/dm3q:16/BP4A.251205.006/S918BXXSAFZF5:user/release-keys |
| Architecture | ARM64 |
| Kernel text base | 0xffffffc008000000 |
| Physical base | 0x80000000 |
| Physical kernel load address | 0x80080000 |
The active constants are stored in target.h.
Reference: https://github.com/NebuSec/CyberMeowfia/blob/main/IonStack/CVE-2026-43499/exploit/src/targets/tokay-CP2A.260605.012 especially /fops.c
The current workflow is
GhostLock -> dangling waiter
TCP Zerocopy -> page UAF
Pipe R/W (modded without configfs?? or it's not patched yet?)
Zero SELinux (security_hook_heads + selinux_state)
??? -> root
This project is intended for education and authorized research on devices you own or have explicit permission to test. Kernel experiments can cause data loss, boot loops, or require a reflash. Use a dedicated test device, keep backups, and never carry offsets across firmware builds without revalidating them!
