CVE-2026-43499-root-KernelSU

# CVE-2026-43499-root-KernelSU

A local privilege escalation adaptation based on kernel vulnerability CVE-2026-43499, with embedded KernelSU integrated. It compiles to produce `preload.so`; upon successful exploitation, KernelSU will be started in `late-load` mode (jailbreak mode). Supports generating `target.h` from `(xbl_config.img / vendor_boot.img) + boot.img`.

Local privilege escalation adaptation based on a kernel vulnerability, integrating embedded KernelSU.
Compiles and generates `preload.so`; upon successful exploitation, KernelSU will be started in `late-load` mode (jailbreak mode).
Supports generating `target.h` from `(xbl_config.img / vendor_boot.img) + boot.img`. or other way

Referenced projects:

- [Linuxoid-cn/CVE-2026-43499-Poc-Analysis](https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis/)
- [x-spy/CVE-2026-43499-popsicle](https://github.com/x-spy/CVE-2026-43499-popsicle)
- [Colorful-glassblock/duchamp-root](https://github.com/Colorful-glassblock/duchamp-root)

>[!IMPORTANT]
>The unauthorized exploitation of vulnerabilities to damage, compromise, or gain access to computer systems is prohibited by law. This project is provided strictly for research, educational, and learning purposes, and may only be used in systems and environments for which prior authorization has been granted. Any use of this project is undertaken at the user's own risk. The authors and contributors assume no liability for any misuse of this project or for any damages, losses, or legal consequences resulting from its use.
>
>Disclaimer: Unauthorized exploitation of vulnerabilities to damage, intrude into, or gain unauthorized access to computer systems may violate applicable laws and regulations. This project is strictly limited to security research, learning, and testing in systems and environments for which lawful authorization has been obtained. Any direct or indirect losses, legal liability, and other consequences arising from the use, misuse, or modification of this project shall be borne solely by the user; the project authors and contributors assume no responsibility.

## Affected Scope

**If your kernel version is {Linux Kernel}, it falls within the affected scope of this vulnerability**

- Linux Kernel < commit **3bfdc63936dd4773109b7b8c280c0f3b5ae7d349**

- **2.6.39** <=  {Linux Kernel} < **6.1.175**
- **6.2** <=  {Linux Kernel} < **6.6.140**
- **6.7** <=  {Linux Kernel} < **6.12.86**
- **6.13** <=  {Linux Kernel} < **6.18.27**
- **6.19** <=  {Linux Kernel} < **7.0.4**

## Current Status

| Target | Status |
| --- | --- |
| `rodin` (default) | Verified |
| Other `src/targets/*` | Reference |

## Directory Structure

```text
.
├── Makefile
├── build/
│   └── embed/
│       └── ksud                 # 被嵌入 preload.so 的 KernelSU userspace binary
├── tools/
│   ├── generate_target.py       # 本仓库统一 target.h 生成入口
│   └── vendor/                  # 从父目录同步的原始生成辅助脚本
└── src/
    ├── main.c                   # exploit 主流程
    ├── preload.c                # LD_PRELOAD constructor + ksud 写出/启动
    ├── root.c                   # cred/seccomp/SELinux/root patch
    ├── slide.c                  # pselect KASLR slide leak
    ├── fops.c                   # pselect/FOPS route
    ├── pipe.c                   # pipe-buffer phys R/W primitive
    ├── ksud_blob.S              # .incbin build/embed/ksud
    ├── kernelsnitch/            # KernelSnitch helpers
    └── targets/
        ├── rodin/
        ├── beryl/
        └── ...
```

## Build

### Dependencies

- Linux host
- Android NDK
  - Default path: `~/android-ndk-r29`
  - Or set: `ANDROID_NDK_HOME` / `ANDROID_NDK_ROOT` / `NDK_ROOT`
- `make`
- `git`

### Build

```bash
make PROJECT=<target> -j$(nproc)
```

Output:

```text
build/<target>/bin/preload.so
```

### List Available Targets

```bash
make list-projects
```

## Generating target.h

This repository already includes a unified target generation script:

```text
tools/generate_target.py
tools/vendor/generate_target.py
tools/vendor/generate_target_2.py
tools/vendor/detect_offset.py
```

`tools/generate_target.py` is the entry-point script. It references and wraps all the target generation flows in the parent directory, and finally outputs a complete `src/targets/<project>/target.h` adapted to this repository's source code.

The script does not strictly validate `CONFIG_DEBUG_INFO_BTF=y` in IKCONFIG. If struct field offsets or the percpu `entry_task` layout cannot be verified, it prints a warning and continues generating.

If the image has no usable BTF at all, for example:

```text
有效 vmlinux BTF 候选不唯一: []
```

the generator will enter the **no-BTF fallback**:

- Continue recovering function/global object symbol offsets from the kallsyms of the current `boot.img`;
- Struct field/layout macros that cannot be recovered from BTF inherit from the template target, with the default template being `rodin`;
- A warning is written at the top of the generated header, indicating `without BTF` and the template used;
- This kind of header is guaranteed to be as compilable as possible, but runtime reliability requires verification on real hardware.

You can specify a fallback template:

```bash
tools/generate_target.py --project <project> --boot boot.img --profile profile.json --template-target rodin
# 或
TARGET_TEMPLATE=rodin tools/generate_target.py --project <project> --boot boot.img --profile profile.json
```

#### 1. Generate from boot.img + profile JSON

```bash
make generate-target PROJECT=<project> BOOT=/path/to/boot.img PROFILE=/path/to/profile.json
```

Writes to by default:

```text
src/targets/<project>/target.h
```

You can also invoke the script directly:

```bash
tools/generate_target.py --project <project> --boot /path/to/boot.img --profile /path/to/profile.json
```

`profile.json` needs to contain physical address information, for example:

```json
{
  "p0_phys_offset": "0x40000000",
  "p0_kernel_phys_load": "0x40000000"
}
```

#### 2. Detect profile from an already-rooted ADB device

Generate the profile only:

```bash
make detect-profile PROFILE_OUT=profile.json
```

Detect the profile and immediately generate the target:

```bash
tools/generate_target.py --project <project> --boot /path/to/boot.img \
  --detect-adb-and-generate --profile-out profile.json
```

#### 3. Generate from (xbl_config.img / vendor_boot.img) + boot.img

The script also exposes other entry points supported by the parent-directory generator:

```bash
tools/generate_target.py --project <project> --boot boot.img --xbl-config xbl_config.img

tools/generate_target.py --project <project> --boot boot.img --mtk-vendor-boot vendor_boot.img

tools/generate_target.py --project <project> --boot boot.img --mtk-partitions /path/to/partitions
```

##### Example

```bash
make generate-target PROJECT=rodin BOOT=../rodin/boot_a PROFILE=../profile.json
make generate-target PROJECT=beryl BOOT=../beryl/boot.img PROFILE=../profile.json
```

A successful output looks like:

```text
生成成功: .../src/targets/<project>/target.h
kernel SHA-256: <sha256>
target macros: 168
```

`rodin` keeps the following value verified on real hardware by default:

```c
#define MM_STRUCT_SZ 0x500
```

To override:

```bash
tools/generate_target.py --project rodin --boot boot.img --profile profile.json --mm-struct-sz 0x...
```

## Adding a New Target

It is recommended to generate from a matching boot image and profile:

```bash
make generate-target PROJECT=<project> BOOT=/path/to/boot.img PROFILE=/path/to/profile.json
make PROJECT=<project> -j$(nproc)
```

A complete target header will contain:

- direct map / physical profile constants
- KASLR slide object offsets
- task / cred / SELinux offsets
- pipe / fops / configfs offsets
- pselect layout values, e.g. `PSELECT_WAITER_WORD_SHIFT`
- `MM_STRUCT_SZ` and KernelSnitch tuning values

## Running

The current source already has the defaults written in. For normal operation, you only need to set `LD_PRELOAD` and execute any program (recommended: `toybox id`).

```bash
adb push build/rodin/bin/preload.so /data/local/tmp/preload.so
adb shell 'chmod 755 /data/local/tmp/preload.so'
adb shell 'LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'
```

## Default Runtime Parameters

The current default configuration is as follows:

| Setting | Default | Description |
| --- | --- | --- |
| `KSUD_LATE_LOAD` | `1` | Run `ksud late-load` |
| `KSUD_ALLOW_SHELL` | `1` | Pass `--allow-shell` |
| `KSUD_PACKAGE` | `me.weishu.kernelsu` | Manager package name passed to ksud (apparently has no effect) |
| `KSUD_DST` | `/data/local/tmp/ksud` | Write path for the built-in ksud |
| `KSUD_SKIP_WRITE` | `0` | Write the built-in ksud by default |
| `KSUD_DEFER_TO_PARENT` | `1` | Start ksud from the patched parent/current process path |
| `ROOT_PATCH_SELF` | `1` | Patch the current process to uid 0 |
| `DISABLE_SELINUX` | `1` | Set SELinux enforcing to permissive during root patch |
| `ROOT_EXIT_SLEEP` | unset / `0` | No extra sleep before returning |

The ksud command actually executed by default is:

```bash
/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu
```

These environment variables can still be overridden at runtime, for example:

```bash
adb shell 'KSUD_PACKAGE=com.example.manager LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'
```

To reuse an already-written `ksud`:

```bash
adb shell 'KSUD_SKIP_WRITE=1 LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'
```

## Cleanup

```bash
make clean
```

`make clean` preserves `build/embed/ksud` because `src/ksud_blob.S` embeds it via:

```asm
.incbin "build/embed/ksud"
```

If manual cleanup causes `build/embed/ksud` to be lost, you can restore it:

```bash
git checkout -- build/embed/ksud
```

## FAQ

### `.incbin "build/embed/ksud"` not found

Restore the built-in payload and rebuild:

```bash
git checkout -- build/embed/ksud
make PROJECT=rodin -j$(nproc)
```

### FOPS route returns `success=0`

`rodin` expects the legacy/simple pselect layout:

```text
pselect fdset simple layout shift=0
pselect returned attempt=1 ret=9 ... success=1
```

If the device state has been polluted by failed attempts, reboot and try again:

```bash
adb reboot
```

### `F_SETPIPE_SZ` returns `EPERM`

This is usually a state issue caused by failed/residual attempts; rebooting is the fastest way to clean it up:

```bash
adb reboot
```

### `ksud` starts but `/proc/modules` has no KernelSU

Check the logs:

```bash
adb shell 'cat /data/local/tmp/ksud.log /data/local/tmp/ksud.preload.log 2>/dev/null || true'
```

If necessary, run it manually in a root shell:

```bash
/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu
```

## License

GPL-3.0. See [`LICENSE`](https://github.com/woshimaniubi8/cve-2026-43499-root-kernelsu/blob/main/LICENSE).