GhostLock Custom — CVE-2026-43499 Adaptation

A GhostLock (CVE-2026-43499) privilege escalation exploit targeting non-Android Linux 6.x ARM64 kernels.

Kernel Characteristics

Item	Value
Architecture	ARM64 (AArch64)
VA_BITS	39
KIMAGE_TEXT_BASE	0xffffffc008000000
Kernel version	6.x
SELinux	None
ashmem	None
configfs	None

Compilation

Local Build (requires a cross-compiler)

make

Android NDK Build

make android-arm64 NDK=/path/to/android-ndk

GitHub Actions (Cloud Build)

Builds are triggered automatically after pushing; just download the artifact.

Usage

# Push to the target device
adb push ghostlock-arm64 /data/local/tmp/e
adb shell chmod 755 /data/local/tmp/e

# Get a root shell
adb shell /data/local/tmp/e --shell

# Adjust the pselect offset (if the default doesn't work)
adb shell PSELECT_SHIFT=-4 /data/local/tmp/e --shell
adb shell PSELECT_SHIFT=-2 /data/local/tmp/e --shell
adb shell PSELECT_SHIFT=0 /data/local/tmp/e --shell
adb shell PSELECT_SHIFT=2 /data/local/tmp/e --shell
adb shell PSELECT_SHIFT=4 /data/local/tmp/e --shell

# Specify the physical load address
adb shell KPHYS=0x80000000 /data/local/tmp/e --shell

Environment Variables

Variable	Default	Description
PSELECT_SHIFT	-2	Offset adjustment for the pselect waiter on the stack
KPHYS	0x80000000	Kernel physical load address
KIMAGE_TEXT_BASE	0xffffffc008000000	Kernel virtual base address

Exploit Mechanism

1. futex PI race: FUTEX_CMP_REQUEUE_PI triggers a UAF in remove_waiter()
2. pselect stack overwrite: The freed rt_mutex_waiter lands in the stack_fds buffer
3. PI tree write: Arbitrary kernel address write via a crafted fake waiter
4. cred overwrite: Overwrite task_struct->cred with init_cred

Adaptation Notes

This version is a stripped-down variant of ghostlock-oneplus:

• Removed SELinux disabling code (this kernel has no SELinux)
• Removed ashmem/configfs-related code (this kernel has none of these components)
• Removed KernelSU installation code
• Removed SLIDE KASLR leak (no loggers/nfulnl_logger)
• Removed Android-specific code (miniADB, etc.)

Troubleshooting

Symptom	Possible Cause	Solution
Device reboots	Incorrect PSELECT_SHIFT	Try each value from -4 to +4
No effect	Incorrect KPHYS	Verify the correct value in /proc/iomem
perf_event_open failed	seccomp restriction	Try running via ADB shell
No root	Offset mismatch	Confirm the kernel version, check TASK_CRED_OFF

Disclaimer

This tool is for security research purposes only. Users assume all responsibility.