OnePlus Ace 6 Temporary Root Tool

Obtain temporary root privileges for the current boot session on OnePlus Ace 6 via CVE-2026-64560 (Linux kernel POSIX CPU timer UAF). Invalidated after reboot, does not modify system partitions.

[!WARNING] May cause device reboot or data loss. Use only on your own device, and back up important data before proceeding.

Supported Devices

Item	Information
Device	OnePlus Ace 6 (OP6113L1)
Firmware fingerprint	OnePlus/PLQ110/OP6113L1:16/BP2A.250605.015/...
Kernel version	6.6.118-android15-8-...

If your system version fingerprint does not match, the tool will refuse to run and report TARGET_PROFILE_GATE_FAIL.

Preparation

1. A OnePlus Ace 6 with a system version matching the above
2. A computer (Windows / macOS / Linux all work)
3. A USB data cable
4. USB debugging enabled on the phone (Settings → About phone → tap Build number 7 times to enable Developer options → Developer options → USB debugging)
5. adb installed on the computer (download link, extract and add the path to your system PATH)

Step 1 — Download the Tool

Go to this repository's Releases page and download the latest cve-2026-64560-fanout-opace6.

Place the downloaded file somewhere you'll remember, such as the Desktop.

Step 2 — Connect the Device

Connect the phone and computer with a USB cable, and tap "Allow USB debugging" on the phone popup.

Open a terminal (on Windows press Win+R, type cmd, and hit Enter), and verify the device is connected:

adb devices

You should see your device serial number with status device. If it shows unauthorized, tap Allow on the phone.

Step 3 — Push to the Phone

Windows:

adb push C:\Users\你的用户名\Desktop\cve-2026-64560-fanout-opace6 /data/local/tmp/
adb shell chmod 777 /data/local/tmp/cve-2026-64560-fanout-opace6

macOS / Linux:

adb push ~/Desktop/cve-2026-64560-fanout-opace6 /data/local/tmp/
adb shell chmod 777 /data/local/tmp/cve-2026-64560-fanout-opace6

Note: You must grant 777 permissions; 755 will result in Permission denied.

Step 4 — Preflight

First run the preflight check to confirm your device can be used:

adb shell /data/local/tmp/cve-2026-64560-fanout-opace6 --preflight

Seeing PREFLIGHT_PASS means everything is fine and you can continue. Seeing TARGET_PROFILE_GATE_FAIL means your system version does not match and cannot be used.

Step 5 — Run

This tool exploits a kernel race condition, which is probabilistic and may require multiple attempts or even multiple reboots.

Method A: Use the Automated Script (Recommended)

The automated script will retry for you, including automatically rebooting the device, waiting for cooldown, and detecting success.

Windows:

Place this repository's scripts\boot-campaign.bat and the downloaded payload in the same folder, then navigate to that folder in CMD and run:

boot-campaign.bat -n 6

-n 6 means up to 6 reboot attempts. The script will automatically:

• Push files to the phone
• Run preflight
• Run the exploit and display progress in real time (attempt count)
• If it fails, reboot the device to cool down and retry
• Exit automatically on success

macOS / Linux:

sh scripts/boot-campaign.sh -p cve-2026-64560-fanout-opace6 -n 6

(Optional: -u cve-2026-64560-su specifies the temp-su path; on success the root session can be used across terminals.)

Method B: Manual Run

adb shell /data/local/tmp/cve-2026-64560-fanout-opace6 --run

If it does not succeed (you don't see ROOT_SUCCESS), reboot the phone and try again. It is recommended to wait until the phone is no longer hot to the touch before retrying; excessively high CPU temperature will reduce the success rate.

Step 6 — Use root

On success you will see ROOT_SUCCESS / ROOT_CHILD_HOLD_PASS. The root shell is in the same terminal window where you ran --run (the exploit will prompt interactive root child; exit to finish), directly type id, and if you see uid=0(root) it means you have obtained root privileges.

If you want to use root in another terminal, you need to first make the root session persistent:

1. Obtain cve-2026-64560-su (not in the Release, see the repository's Actions build artifacts, or compile src/temp-su.c with the Android NDK), and push it to the phone:

   adb push cve-2026-64560-su /data/local/tmp/su
   adb shell chmod 755 /data/local/tmp/su
   

2. In the exploit's root shell, execute:

   /data/local/tmp/su --daemon
   

3. Afterwards, in any terminal, run adb shell /data/local/tmp/su and type id to verify.

Note: When using boot-campaign.bat / boot-campaign.sh, place cve-2026-64560-su in the same directory as the payload (or specify the path with -u), and the script will automatically push it and start the daemon.

Important: root privileges are only valid for the current boot; after rebooting the phone you need to run it again. It does not modify the boot, vendor, or system partitions, and does not affect OTA updates.

Source and License

Upstream: NebuSec/CyberMeowfia. For specific revisions and Linux fixes, see docs/UPSTREAM.md. Apache License 2.0; see LICENSE and NOTICE.