nanoturtle1145/root-my-s9280Using CVE-2026-43499 to root your Galaxy S24 Ultra(SM-S9280 ,(China / Hong Kong SAR / Taiwan))
Root Samsung Galaxy S24 Ultra (SM-S9280 Mainland China / Hong Kong / Taiwan) without bootloader unlock — a security research project based on kernel vulnerability CVE-2026-43499.
Security research disclaimer: This project is intended solely for security research and maintaining your own devices. Using a kernel vulnerability for privilege escalation can cause system crashes, data loss, or bricked devices. You assume all risks and consequences. Do not use it for illegal purposes.
| Item | Value |
|---|---|
| Device | Samsung Galaxy S24 Ultra |
| Model | SM-S9280 (Mainland China CHC / Hong Kong TGY / Taiwan BRI) |
| Firmware | S9280ZCS6DZF2 (One UI 8.5) |
| Kernel | 6.1.145-android14-11-3254743-abS9280ZCS6DZF2 |
Adapting to other devices/firmware: on the same e3q platform (S24 series), symbols in the same firmware generation are essentially identical, so adaptation is theoretically feasible; different build numbers require per-symbol comparison and correction (between S9280 and S928U1 in this project, only the
kmalloc_cachessymbol differs); cross-platform / cross-major-version adaptation needs a complete re-baseline, and the vulnerability may already be patched. See the repository docs and the adaptation workflow: extract the firmware kernel → restore symbols with vmlinux-to-elf → compare item by item against the reference target.h → generate the target configuration → verify on a real device.
The exploit is probabilistic; just retry after a failure or reboot (the success rate accumulates with each attempt).
exploit completed + retval=0 socket=1)./gradlew assembleDebug # debug APK
./gradlew assembleRelease # release APK (configure your own signing)
Payloads (exploit / root helper / ksud) are bundled in app/src/main/assets/. The payload build chain is the developer's responsibility and is outside the scope of this repository.