S26 (SM-S942U1 / m1q) GhostLock CVE-2026-43499 — SELinux Permissive Achieved

Privilege escalation research on CVE-2026-43499 (GhostLock) for the Samsung Galaxy S26 (SM-S942U1, codename m1q, SoC SM8850 Snapdragon 8 Elite Gen2, kernel 6.12.30-android16-5, Android 16).

Status Summary

Root Cause (the real culprit behind the long-standing failures)

1. The US version uses KASLR, not nokaslr. slide is randomized at each boot (measured: 0x30000/0x50000/0x130000/0x150000…). The original public polygraphene/CyberMeowfia code hardcodes slide=0, so all addresses are wrong. Fix: ported m3q-azf1's tracefs KASLR probing (slide_tracefs.c).

2. The US version's GhostLock write primitive only supports "writing NULL". The m3q target.h comments make it explicit: STORE (rb_right writes non-NULL) "KP's off-page", shape0 (rb_left) "KPs on AZF1", and only EMERALD_NULL (rb writes NULL) works. The SELinux write happens to be "writing NULL 0 to enforcing", so it succeeds.

🛑 Hard Technical Boundary for uid=0

polygraphene's uid=0 scheme (dirty-pipe) relies on writing CAN_MERGE(0x10) (non-NULL) to pipe_buffer.flags. The US version's (MTE + KDP) write primitive can only write NULL; writing a non-NULL value results in a deterministic kernel panic (measured 4/4 KP).

This cannot be overcome by parameter tuning — it requires finding a different read/write primitive CVE that can write non-NULL values (the m3q author likewise confirms in the README: "Soft-root still needs info leak + cred finish").

Directory Structure

├── README.md                              # 本文件
├── docs/
│   └── M1Q_SELINUX_WRITE_FAIL_ROOTCAUSE.md  # 完整诊断 + 根因 + 边界
├── m3q-azf1/                              # m3q 树（SELinux park 参考实现）
│   ├── generate_target.py                  # target.h 自动生成工具
│   ├── build_m1q.bat                       # NDK r29 构建脚本（美版 target）
│   ├── target.h                            # 美版 target（P0=0xc7800000, N1b=0）
│   └── preload-4-s1.so                     # SELinux Permissive 达成版（111KB）
├── polygraphene/                          # polygraphene 树（uid=0 完整流程 + KASLR 修复）
│   ├── src/slide_tracefs.c                 # tracefs KASLR 探测（核心修复）
│   ├── src/main.c                          # 加 tracefs KASLR 调用
│   ├── src/util.c                          # SELinux NULL 写 + 空 pi_waiters
│   ├── src/fops.c                          # fd_set 布局
│   ├── targets/m1q-S942U1UES4AZG3/target.h # 美版 target
│   ├── build_r29.bat                       # 构建脚本
│   └── preload.so                          # SELinux 单进程成功版（162KB）
├── auto_run.ps1                           # 自动化重试脚本（含 root 检测）
└── kallsyms/                              # 美版内核符号表
    └── kallsyms.txt                        # 128307 符号（5.7MB）

Reproduction: Achieving SELinux Permissive

Prerequisites

• Device: SM-S942U1, S942U1UES4AZG3, USB debugging
• Host: Windows, adb, Android NDK r29

Method A: polygraphene tree (single-process, includes uid=0 flow)

# 构建（已含 tracefs KASLR 修复）
cd polygraphene
cmd /c build_r29.bat

# 推送 + 运行
adb push build/m1q-S942U1UES4AZG3/bin/preload.so /data/local/tmp/preload.so
adb shell "env LD_PRELOAD=/data/local/tmp/preload.so /system/bin/true"
# 观察日志，SELinux 成功后 getenforce → Permissive

Method B: m3q tree (dedicated to SELinux park)

cd m3q-azf1
cmd /c build_m1q.bat
adb push source/build/bin/preload-4-s1.so /data/local/tmp/preload-4-s1.so
adb shell "LD_PRELOAD=/data/local/tmp/preload-4-s1.so /system/bin/true"
# 成功标志：slide-kaslr-ok + S1_READY + getenforce → Permissive

Key Parameters (authoritatively confirmed, do not change)

Risks (Must Read)

• Frequent kernel panics (~44% success rate per write primitive; the rest are KP reboots)
• Delayed KP (KP may still occur a few minutes after parking)
• Risk of safe-mode-only boot / factory-reset
• Only for devices you own, experimental exploit

Acknowledgments

• polygraphene/CyberMeowfia (S26 dirty-pipe port)
• Bugel/cve-2026-43499-m3q-azf1 (m3q reference, tracefs KASLR + I4 emerald / M1Q shape)
• PeronGH/ghostlock-selinux-disabler (JoinChang full-version single-write extraction, shape reference)
• NebuSec (vulnerability discovery/principles)
• JoinChang/ghostlock-oneplus (original exploit)