
Device-specific CVE-2026-43499 root payloads and KernelSU artifacts for Samsung Galaxy models, with firmware profiles, exploit source, and a support feed.
This repository contains the device-specific native side of Root My Galaxy:
It intentionally does not contain Android application source code.
| Payload | Compatible models | Kernel version | Status |
|---|---|---|---|
r9q-G990B2XXSJIZF1 | Galaxy S21 FE 5G SM-G990B2 | 5.4.289 | Testing in progress |
galaxy-s25-series-2026-06-07 | Galaxy S25, S25+, S25 Edge, and S25 Ultra regional models | 6.6.98 | Device-tested |
e3q-S928USQS6DZF2 | Galaxy S24 Ultra SM-S928U | 6.1.145 | Hardware debugging in progress |
essi-A566EXXSCCZG6 | Galaxy A56 5G SM-A566E | 6.6.102 | Device-tested |
Schema version 3 keeps each exploit and KernelSU artifact once. Its flat
models and kernelVersions arrays define runtime compatibility. See
support/README.md for the matching rules.
The port is based on the exploit source published at https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499/exploit.
Root My Galaxy resolves the payload repository's current commit first and
fetches support/targets-v3.json and every artifact from that immutable
commit. Per-artifact SHA-256 fields and manifest signatures are not part of
schema version 3. targets-v2.json is retained for released 0.2.3 clients.
make TARGET=r9q-G990B2XXSJIZF1 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=pa3q-S938NKSUACZF1 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=e3q-S928USQS6DZF2 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=essi-S721NKSSCDZF3 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=e1s-S921BXXSFDZF2 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=a15-A155NKSS6BYH1 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=essi-A566EXXSCCZG6 ANDROID_NDK_HOME=/path/to/android-ndk
Outputs:
build/<profile>/cve-2026-43499
build/<profile>/cve-2026-43499-app.so
build/<profile>/cve-2026-43499-root
The release app payload is built with:
make TARGET=essi-S721NKSSCDZF3 ANDROID_NDK_HOME=/path/to/android-ndk release
The complete firmware-to-profile procedure is recorded in
docs/PORTING.md. Samsung-specific KernelSU changes and
versioned artifacts are documented in kernelsu/README.md.
The exact S921B DZF2 analysis is recorded separately in
docs/SM-S921B-S921BXXSFDZF2.md, and the
S928U/S928U1 DZF2 analysis is in
docs/SM-S928U1-S928U1UES6DZF2.md. S921B
is an Exynos 2400 target and is not a Qualcomm/Snapdragon reference for E3Q.
The 5.10 A15 analysis is in
docs/SM-A155N-A155NKSS6BYH1.md.
The SM-A566E CCZG6 analysis and validation record is in
docs/SM-A566E-A566EXXSCCZG6.md.
Use only on devices you own or are explicitly authorized to test.