CVE-2026-43499 Exploit for Redmi Turbo 5

This preload library is built from the duchamp-root source code.

⚠️ WARNING: For educational and authorized security research purposes only.

This repository provides a proof-of-concept exploit for CVE-2026-43499 (GhostLock) targeting the Xiaomi Redmi Turbo 5 device. The exploit leverages a use-after-free vulnerability in the Linux kernel's futex PI (Priority Inheritance) requeue path to achieve local privilege escalation and install KernelSU without unlocking the bootloader or modifying the boot image.

⚠️ Disclaimer

THIS SOFTWARE IS PROVIDED FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY.

• DO NOT use this exploit on devices you do not own or are not explicitly authorized to test.
• DO NOT use this exploit for any illegal or malicious purposes.
• Privilege escalation may cause device damage or data loss. Please backup all important data before execution.
• The author assumes no responsibility for any damage, data loss, or legal consequences arising from the use of this software.
• By using this software, you agree that you are solely responsible for your actions.

Device Information

Note: This exploit is specifically adapted for the kernel version and firmware listed above. Using it on different kernel versions or firmware may not work and could cause unexpected behavior.

Usage

Prerequisites

1. KernelSU must be installed on the device. Download from: https://github.com/tiann/KernelSU
2. ADB (Android Debug Bridge) must be available on your computer.
3. USB debugging must be enabled on the device.
4. The device must be running the exact kernel version specified above.

Step-by-Step Instructions

1. Download the Release

2. Push the Preload Library to the Device

Use ADB to push the preload.so library to the device's temporary directory:

adb push preload.so /data/local/tmp/preload.so

3. Set Permissions and Execute

adb shell chmod 744 /data/local/tmp/preload.so
adb shell export LD_PRELOAD=/data/local/tmp/preload.so
adb shell sh

Verify Root Access

Upon successful privilege escalation, the device will automatically redirect to the KernelSU interface. You can verify root access by checking the KernelSU manager app.

Important Notes

1. Red error messages may appear during the privilege escalation process. This is normal and can usually be ignored as long as the device does not reboot.
2. Success is not guaranteed — the exploit may not work on every attempt due to kernel race conditions and memory layout variations. If too many errors occur or the device reboots, simply try again.
3. Repeated reboots — if the device reboots over 5 times consecutively, there may be a device-specific issue. In this case, stop and reassess.
4. Included files — the release package contains target.h, which can be used to rebuild the exploit or port it to other projects.