Xiaomi 15 (dada) CVE-2026-64560

Device-specific adaptation of the NebuSec CVE-2026-64560 Android proof of concept for one exact Xiaomi 15 build. It provides temporary root access for the current boot through an ADB-shell-only helper.

[!WARNING] This is experimental kernel exploit code. It can reboot the device, corrupt kernel state, or cause data loss. Use it only on a device you own or are explicitly authorized to test. Back up important data first.

Supported target

The runner rejects an unexpected fingerprint and verifies every bundled payload before execution. This repository does not contain firmware images, device keys, or device-unique secrets.

Usage

Requirements:

• Windows PowerShell
• Android Platform Tools with adb available on PATH
• USB debugging enabled and authorized

From the repository root:

powershell -ExecutionPolicy Bypass -File .\scripts\root.ps1

If more than one ADB device is connected, select one explicitly:

powershell -ExecutionPolicy Bypass -File .\scripts\root.ps1 -Serial SERIAL

After ROOT_SUCCESS, any new terminal can open the temporary root shell:

adb -s SERIAL shell -t /data/local/tmp/su

Run id to verify uid=0(root). Access lasts only for the current boot; rerun the script after a reboot. No boot, vendor, or system partition is modified.

The exploit contains a probabilistic kernel race. The runner automatically uses two independently verified reclaim strategies and cold-boots between unsafe or inconclusive outcomes. The default limit is 12 boots and can be changed with -MaxBoots.

Build

Android NDK r29 and API 35 are the reproducible-build defaults:

.\scripts\build.ps1

The script builds both exploit strategies and the temporary-su helper, strips the outputs, and verifies their pinned SHA-256 values.

Porting toolkit

Create a read-only draft profile for another connected device and register its exact boot/Image hashes:

.\scripts\new-target.ps1 -Target TARGET `
  -BootImage .\stock_boot.img `
  -DecodedImage .\Image

Generated profiles are always marked draft. The release runner refuses them until device-specific offsets, race parameters, restoration gates, artifact hashes, and the complete chain have been reviewed and verified. See docs/PORTING.md for the workflow.

Repository layout

Provenance and license

The primary upstream is NebuSec/CyberMeowfia. Exact revisions and Linux fixes are listed in docs/UPSTREAM.md. This adaptation retains the upstream Apache License 2.0; see LICENSE and NOTICE.