GhostLock (CVE-2026-43499) for the Galaxy S26

CVE-2026-43499 ported to the Samsung Galaxy S26 series — Android 16 / GKI 6.12. One binary, three kernel lines, dynamic parameter matching at runtime: theoretically covers the whole S26 series without per-build compilation.

Most GhostLock porting efforts target a single device or a single firmware. This repository is a fresh port that rewrites every mechanism for the S26 target and is expected to cover the whole family.

At a glance

While maintaining snothin/CyberMeowfia, I found the original pipe physrw channel unstable (it severed the network), so I dropped that route and explored alternatives. Later I found that monovibe had gone further along the path I was exploring, adopted the approach, and after repeated debugging this repository took shape.

• Bug: futex PI use-after-free race → pselect fd_set seeding → one aligned qword kernel write per round → arbitrary physical read/write.
• Devices: Galaxy S26 / S26+ / S26 Ultra, Snapdragon (CN + intl) and Exynos variants.
• Result: usermode helper runs as uid=0(root) context=u:r:kernel:s0; persistent root shell via su_daemon on an abstract unix socket.
• KDP bypass: no credential writes — the root stage forges a work_struct on system_unbound_wq whose function is call_usermodehelper_exec_work, so the kernel executes our daemon with init creds. KDP's EL2 guard on credential pages is never triggered.
• DEFEX bypass: the helper bind-mounts the daemon over a dormant system binary before exec; DEFEX's safeplace rule sees a whitelisted path.

Attack flow

pselect + futex PI race
  → one aligned qword write per round
  → attr carrier (two fake misc fds)
      controller fd retargets the data pointer
      data fd reads/writes any kernel address
  → slide oracle (tracefs)
  → UMH root (workqueue injection)
      system_unbound_wq
      ptmx open/close storm wakes a worker
      kernel execs daemon with init creds
  → DEFEX bypass (bind-mount)
  → su_daemon listens on /data/local/tmp/temp_su.sock

Supported firmware

Parameters are matched by kernel line (three lines: cn, intl, exynos), not by individual build. Unknown OTA builds fall back to the closest known line by model and CSC. Completely unknown models are rejected (fail-closed). The embedded build list is authoritative in exploit/src/params_table.c. See PORTING.md for the parameters needed when porting to a new device or firmware.

Build

Requires Android NDK (r26+). Just run:

cd exploit
make preload
# produces build/bin/preload.so (exploit) and build/embed/su_daemon_aarch64_pie (embedded daemon)

Usage

Push preload.so, su_daemon_aarch64_pie and ksud to the device (run from an adb shell session, uid 2000):

adb push exploit/build/bin/preload.so /data/local/tmp/
adb push exploit/build/embed/su_daemon_aarch64_pie /data/local/tmp/cve-2026-43499-root
adb push <ksud> /data/local/tmp/ksud
adb shell chmod 755 /data/local/tmp/cve-2026-43499-root /data/local/tmp/ksud

# Single attempt:
adb shell "env LD_PRELOAD=/data/local/tmp/preload.so sh"

The exploit is probabilistic (a race) and usually needs repeated attempts. On a successful run, su_daemon listens on /data/local/tmp/temp_su.sock, and any local process can connect.

The boot-claim guard (/data/local/tmp/ghostlock-boot.log) records the outcome of each boot's run; a second full-chain run in the same boot is rejected (it can crash the device). Clear the file or set BOOT_FORCE=1 to override.

Credits

• Nebula Security — CVE-2026-43499 discovery
• polygraphene — CyberMeowfia baseline (first CVE implementation)
• monovibe — s26u-m3q-temp-root: per-child lock regions, UMH root, boot-claim discipline
• lukasmaar — kernelsnitch: mm_struct futex-hash leak (vendored in exploit/src/kernelsnitch/)
• veritas501 — pipe-primitive: pipe CAN_MERGE overwrite concept
• BuSung-dev — Root-My-Galaxy: base for the companion app

This repository is released under the Apache-2.0 License; see LICENSE for the full text and NOTICE for code provenance.