GhostLock (CVE-2026-43499) for Galaxy Z Fold 8 (h8q) / Fold 8 Ultra (q8q)

Most of this code is based on @polygraphene's fork of the original. Heavy modifications were required because the main primer used (select()) for most published variants of the exploit does not properly align with the rt_mutex_waiter struct on these 6.12 Samsung targets. io_submit() is used instead.

Working: h8q-F971USQU1AZFW (SM-F971U, P0=0xc7800000). Build with make PROJECT=h8q-F971USQU1AZFW.

Build

git clone (this repo)
cd (this repo)
export ANDROID_NDK_ROOT=(your ndk path)
make

Build ksud + kernelsu.ko using this tree by polygraphene and following this instruction. This tree contains a patch from BuSung-dev/Root-My-Galaxy and 6.12 adaptation.

Run

$ adb install /path/to/KernelSu_Manager.apk
$ adb push build/preload.so /data/local/tmp/
$ adb push $KERNELSU/target/aarch64-linux-android/release/ksud /data/local/tmp/
$ adb shell env LD_PRELOAD=/data/local/tmp/preload.so sh -c 'echo PWND'

Acknowledgments

• @polygraphene: Most of this code is based on his fork of the original for compatibility with Samsung devices running kernel 6.12
• Nebula Security: Vulnerability and original exploit
• @lukasmaar: This exploit is heavily dependent on kernelsnitch
• @diabl0w: q8q io_submit primer
• BuSung-dev: Samsung KDP/RKP/DEFEX KernelSU patch