sganggs/cve-2026-98260-brm-an00CVE-2026-98260 temporary root for HONOR Win2 BRM-AN00, handed to BakaSU. No flashing.
On my own HONOR Win2, replay CVE-2026-98260 against Magic OS 11 / Android 17 to obtain root for this boot session, then hand it over to BakaSU (ReSukiSU) for management. No unlocking, no flashing partitions, no installing system updates. After a reboot, the modules and /system/bin/su will both disappear, and it needs to be run again.
Only applies to this kernel version:
6.18.21-android17-5-ge186062ea75f-abogki564062290-4k
Corresponds to system BRM-AN00 11.0.0.115(SP7C00E115R101P3). Another phone of the same model with the same firmware can use it, because KASLR is re-measured on every boot. It does not apply if the system version or security patch differs; the struct offsets are recalculated for this kernel.
The upstream fix is acb03d388181 (exec: Cleanup POSIX timers right after de_thread), which landed in 6.18.54. This kernel is 6.18.21, built on 2026-09-20, and does not contain this fix.
A public port on another machine is at CVE-2026-98260-nezha-android. The k_itimer size and node offsets there cannot be used directly. The measurements for this repository are recorded in plant/ADAPTATION-BRM.md.
A POSIX CPU timer for CLOCK_THREAD_CPUTIME is not cleaned up after de_thread and before exec_mmap. If a non-leader thread is SIGKILLed on mmap_read_lock_killable while executing, exit_itimers frees the k_itimer first, and when the parent process reaps it, timerqueue_del is still holding the already-freed node.
On this kernel, the timer used for arming must be SIGEV_SIGNAL. SIGEV_NONE does not enter the timerqueue. What gets freed is a single order-1 page, and an 8KB unix SOCK_STREAM write can occupy it. After occupying it, the reaping path writes the forged cred address into the leaked task + 0x908. Then two zero writes clear the uid/gid and suid/sgid dirtied during erasure. getuid reads cred, while /proc/pid/status reads real_cred (task + 0x900), so proc may still show the original uid.
While SELinux is still Enforcing, the new cred cannot open new files. The inquiry goes through a pipe created before privilege escalation. Writing selinux_state - 7 can clear the enforcing byte. After BakaSU late-load succeeds, it sets SELinux back to Enforcing according to its own design.
When the page is missed, the parent process stays in place and does not exit. init reaping the node still on the queue may crash the machine.
plant/: measures the slide, page occupancy, writes cred, temporary root socket. uaf_plant.c is the main program.app/: BRM ReSuki on the phone. Uses Shizuku (the same identity as adb shell) to run the above program, then late-loads BakaSU.third_party/: does not include ksud and the manager APK; put them in yourself.Install zig, then:
powershell -File plant/build.ps1
The outputs are plant/uaf_plant_replay, slide_probe, pc98260-su, cap_check, targeting aarch64-linux-musl.
Replay on the computer:
$env:ADB = 'adb.exe'
powershell -File plant/replay.ps1
When only one phone is connected, there is no need to set ANDROID_SERIAL. third_party/ksud and third_party/manager.apk must be put in place first. The late-load parameters are ksud late-load --kmi android17-6.18 --allow-shell --package-name com.resukisu.resukisu.
Building the phone app depends on JDK 17, android.jar, aapt2/d8/zipalign/apksigner in build-tools, and the Shizuku jar. See app/build.ps1.