CVE-2026-43499 — GhostLock on Huawei Nova 9 (NAM-AL00)

Security research: on-device confirmation and exploitation analysis of CVE-2026-43499 (GhostLock) on Huawei Nova 9 (NAM-AL00, Snapdragon 778G/SM7325, HarmonyOS 4.2.0.185, kernel 5.4.86-qgki).

Summary

CVE-2026-43499 is a stack use-after-free in the Linux kernel's rt_mutex subsystem, introduced in v2.6.39 (2011). This repository confirms the vulnerability fires deterministically on NAM-AL00 running HMOS 4.2 with SPL 2025-07-01, documents the complete exploitation methodology, and analyzes why full root was not achieved.

Confirmed

✅ EDEADLK rollback fires deterministically (bug trigger)
✅ KASLR defeated per-boot via perf_event callchain leak
✅ Full symbol recovery (224,986 symbols from raw Image)
✅ Dual-planter delivery verified aligned (pselect6 + PR_SET_MM_MAP)
✅ Walk consumes forged waiter fields (wedge = proof of dereference)

Not achieved

❌ Arbitrary write proof (Huawei-modified walk semantics prevent clean termination)
❌ Temp root (blocked by post-exit cleanup + in-walk divergence)

Key findings

Finding	Detail
HKIP	NOT present on SM7325 (EL2 = Qualcomm Haven)
SLAB_FREELIST_HARDENED	NOT SET — freelist pointers unhardened
CONFIG_FUTEX_PI	y — vulnerable code path present
check_root module	Built-in anti-root detector at EL1
PR_SET_MM_MAP planter	Copy-before-capable-check enables unprivileged stack planting

Files

poc/poc_trigger.c      — deterministic EDEADLK trigger (stage-1 PoC)
poc/perf_probe.c       — KASLR slide extraction via perf_event
exploit/stage3_main.c  — integrated pipeline (trigger→plant→punch→oracle)
exploit/escalate.c     — post-write escalation core (cred/sid/seccomp)
exploit/stage2_forge.h — forged rt_mutex_waiter composer
sim/sim_final.py       — Unicorn emulator oracle (offline walk trace)
offsets/offset.h       — all verified symbol addresses & struct layouts
analysis/kernel.config — extracted build configuration
analysis/symbols.txt   — 224,986 recovered kallsyms entries

Build

# Trigger PoC
${NDK}/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android33-clang \
    -O2 -static -pthread -o poc_trigger poc/poc_trigger.c

# Run on device
adb push poc_trigger /data/local/tmp/
adb shell /data/local/tmp/poc_trigger 10

References

License

MIT

Most Popular

CVE-2026-43499-NAM-AL00