CVE-2026-98260 · Xiaomi 15 (dada) Android 17 Port

A temporary local privilege escalation PoC targeting OS4.0.0.22.XOCCNXM and its exact kernel build. CVE-2026-98260 has been reproduced on a real device from an ordinary ADB shell, obtaining SELinux Permissive and UID/GID 0 within the same boot cycle.

Item	Verified Value
Device	Xiaomi 15, codename dada
Firmware	OS4.0.0.22.XOCCNXM, Android 17
Fingerprint	Xiaomi/dada/dada:17/CP2A.260605.016/OS4.0.0.22.XOCCNXM:user/release-keys
Kernel	6.6.118-android15-8-gb9cc6ec16bc8-abogki536571621-4k
Starting point	Authorized ordinary ADB shell, UID 2000, SELinux Enforcing
Result	New ADB session obtains UID/GID 0 and SELinux Permissive via the temporary client

This result does not include full Linux capabilities: the temporary root shell has CapEff=0. The source uses a controlled 8-byte zeroing write to change UID/GID and SELinux state, without setting any capability bit to 1. Validation scope defines the success conditions and limitations.

Building from Source

Install Android Platform Tools, Android NDK r29 (29.0.14206865) and r28.2 (28.2.13676358) on Windows. The main payload is built statically with r29/API 35; the generic order1-churn helper uses r28.2/API 35. If the NDKs are located in other directories, pass -Ndk29 and -Ndk28.

powershell -NoProfile -ExecutionPolicy Bypass -File .\build.ps1 -VerifyReference

-VerifyReference compares the SHA-256 of the four rebuilt artifacts one by one against the release binaries in bin/. The full hashes pin the release version; the build process does not connect to the phone.

Running on an Authorized Device

Connect and authorize an exact target device, and add adb to PATH:

powershell -NoProfile -ExecutionPolicy Bypass -File .\run_98260.ps1

If multiple ADB devices are present, pass -Serial <device serial number>. The script verifies the device codename, full fingerprint, kernel, the four local and on-device binary hashes, and the boot ID, then runs the SELinux and UID/GID stages separately. Success is reported only when a new ADB session confirms UID 0 and Permissive. By default, each stage attempts up to three times; on encountering PARKED it stops, and its dangerous zombie must not be manually reaped. Raw output is kept only locally in the Git-ignored logs/.

After success, run a UID 0 command in the current boot cycle:

adb shell /data/local/tmp/dada98260-su -c id

The exploit relies on probabilistic page reclamation and is not guaranteed to hit every time. After a reboot, the memory modifications and temporary service are gone. This repository does not flash any partition, nor does it claim support for other firmware or for the same version string with a different kernel image.

Technical and Disclosure Boundaries

• Vulnerability path and exploitation method
• Exact image, symbol and BTF verification
• On-device validation and limitations
• Upstream research and sources

The repository contains only the source code for CVE-2026-98260, rebuildable on-device programs, and curated success facts. Raw boot images, partition images, bugreports, device serial numbers, runtime addresses, raw logs, and failed attempts are not uploaded. The project's original code and documentation are under the MIT License; third-party licenses from the Android NDK involved in the prebuilt binaries are listed in the notices.