wangs-official/opace6-cve-2026-64560Temporary root tool for OnePlus Ace 6 that exploits the CVE-2026-64560 Linux kernel POSIX CPU timer use-after-free to gain root until reboot, without modifying system partitions.
Obtain temporary root privileges for the current boot session on OnePlus Ace 6 via CVE-2026-64560 (Linux kernel POSIX CPU timer UAF) vulnerability. Invalidated after reboot, does not modify system partitions.
[!WARNING] May cause device reboot or data loss. Use only on your own device, and back up important data before proceeding.
| Item | Information |
|---|---|
| Device | OnePlus Ace 6 (OP6113L1) |
| Firmware fingerprint | OnePlus/PLQ110/OP6113L1:16/BP2A.250605.015/... |
| Kernel version | 6.6.118-android15-8-... |
If your system version fingerprint does not match, the tool will refuse to run and prompt TARGET_PROFILE_GATE_FAIL.
adb installed on the computer (download link, extract and add the path to your system PATH)Go to this repository's Releases page and download the latest version of cve-2026-64560-fanout-opace6.
Place the downloaded file somewhere you'll remember, such as the desktop.
Connect the phone and computer with a USB cable, and tap "Allow USB debugging" on the popup on the phone.
Open a terminal (on Windows press Win+R, type cmd, and press Enter), and verify the device is connected:
adb devices
You should see your device serial number with status device. If it shows unauthorized, tap Allow on the phone.
Windows:
adb push C:\Users\你的用户名\Desktop\cve-2026-64560-fanout-opace6 /data/local/tmp/
adb shell chmod 777 /data/local/tmp/cve-2026-64560-fanout-opace6
macOS / Linux:
adb push ~/Desktop/cve-2026-64560-fanout-opace6 /data/local/tmp/
adb shell chmod 777 /data/local/tmp/cve-2026-64560-fanout-opace6
Note: You must grant
777permissions;755will report Permission denied.
First run the preflight check to confirm your device can be used:
adb shell /data/local/tmp/cve-2026-64560-fanout-opace6 --preflight
Seeing PREFLIGHT_PASS means everything is fine and you can continue.
Seeing TARGET_PROFILE_GATE_FAIL means your system version does not match and cannot be used.
This tool exploits a kernel race condition, which is probabilistic and may require multiple attempts or even multiple reboots.
The automated script will retry for you, including automatically rebooting the device, waiting for cooldown, and detecting success.
Windows:
Place this repository's scripts\boot-campaign.bat and the downloaded payload in the same folder,
then navigate to that folder in CMD and run:
boot-campaign.bat -n 6
-n 6 means up to 6 reboot attempts. The script will automatically:
macOS / Linux:
sh scripts/boot-campaign.sh -p cve-2026-64560-fanout-opace6 -n 6
adb shell /data/local/tmp/cve-2026-64560-fanout-opace6 --run
If it does not succeed (you don't see ROOT_SUCCESS), reboot the phone and try again. It is recommended to wait until the phone no longer feels hot before trying again;
excessively high CPU temperature will reduce the success rate.
After success you will see ROOT_SUCCESS; at this point open a new terminal window:
adb shell /data/local/tmp/su
Then type id; if you see uid=0(root), that means you have obtained root privileges.
Important: root privileges are only valid for the current boot; after the phone reboots you need to run it again. It does not modify the boot, vendor, or system partitions, and does not affect OTA updates.
Q: What should I do about Permission denied?
Run adb shell chmod 777 /data/local/tmp/cve-2026-64560-fanout-opace6.
Q: What should I do about TARGET_PROFILE_GATE_FAIL? Your system version does not match this tool. Adaptation for the corresponding version is required.
Q: It ran for a long time with no response? This is normal. The exploit is a probabilistic kernel race, and each attempt takes 20-30 seconds. If one round (32 attempts) does not hit, the script will automatically reboot and try again. A few more rounds usually succeed.
Q: What should I do if the phone reboots? Sometimes the exploit triggers a kernel crash causing a reboot; this is normal, just run it again.
Q: Can I still use it if I already have KernelSU / Magisk installed? If you have modified the kernel (for example, flashed KSU), the actual kernel differs from the stock one and it may fail. It is recommended to use the stock boot.
Q: What does draft status mean?
This adaptation has not yet been fully verified on a real Ace 6 device; the race parameters are inherited from OP13 and may need tuning.
The 0x28000000 of physical_delta also needs to be confirmed on a real device via --preflight.
Upstream: NebuSec/CyberMeowfia. For specific revisions and Linux fixes, see docs/UPSTREAM.md. Apache License 2.0; see LICENSE and NOTICE.