Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Lenovo-TB365FC-GhostLock-CVE-2026-43499 — GhostLock (CVE-2026-43499) root + KernelSU LKM for the Lenovo TB365FC (ZUXOS / Android 16, kernel 5.15.170) | Kitploit
Tools/GitHubGitHub/wonjj6768/lenovo-tb365fc-ghostlock-cve-2026-43499
Android SecurityPrivilege EscalationPersistence MechanismsExploitationMobile App PentestingPost-ExploitationMobile SecurityPayload DevelopmentBinary Exploitation
GitHubwonjj6768/lenovo-tb365fc-ghostlock-cve-2026-43499

Lenovo-TB365FC-GhostLock-CVE-2026-43499

13622 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

GhostLock (CVE-2026-43499) root + KernelSU LKM for the Lenovo TB365FC (ZUXOS / Android 16, kernel 5.15.170)

View Repository

GhostLock for Lenovo TB365FC

Root for ZUXOS / Android 16 via CVE-2026-43499 (rtmutex remove_waiter() use-after-free) plus a DirtyPipe credential patch. Loads a KernelSU LKM without unlocking the bootloader or flashing. Root is lost on reboot.

  • Firmware: ZUXOS 1.5.10.178
  • Kernel: 5.15.170-android13-8-00003-g9a0b9d56c900-ab13225392 (gated; a mismatch can panic)

Download

GhostLock-TB365FC-v1.10.zip — 176 MB (all releases)

Extract it. Nothing else is needed — the ZIP carries adb, Git Bash and the prebuilt binaries.

Use

  1. On the tablet (first time only): Settings → About tablet → tap Build number 7 times, then Settings → Developer options → turn on USB debugging.
  2. Plug in the tablet over USB, keep the screen unlocked, and tap Allow when it asks about USB debugging.
  3. Double-click ghostlock.bat.

It roots the tablet, installs KernelSU, NeoZygisk and Vector, and verifies each step. Takes a few minutes; the UI blinks once while Vector sets up. Internet is needed on the first run to download NeoZygisk and Vector.

Root is lost on reboot — run ghostlock.bat again to re-root.

Notes

  • Root channels (FIFO, loopback shell) are unauthenticated. Device-owner use only.

Credits

  • AnonymousUser369/GhostLockAdapt - ported src/kaslr_perf.c
  • NebuSec/CyberMeowfia, x-spy/CVE-2026-43499-popsicle, YuKongA/ghostlock-app - GhostLock references
  • tiann/KernelSU, JingMatrix/NeoZygisk, JingMatrix/Vector

License

This project: Apache-2.0, except the ported src/kaslr_perf.c.

  • kernelsu.ko - GPL-2.0-only
  • ksud, KernelSU-manager.apk - GPL-3.0-or-later
Download Tool