GhostLock for Lenovo TB365FC

Root for ZUXOS / Android 16 via CVE-2026-43499 (rtmutex remove_waiter() use-after-free) plus a DirtyPipe credential patch. Loads a KernelSU LKM without unlocking the bootloader or flashing. Root is lost on reboot.

• Firmware: ZUXOS 1.5.10.178
• Kernel: 5.15.170-android13-8-00003-g9a0b9d56c900-ab13225392 (gated; a mismatch can panic)

Download

GhostLock-TB365FC-v1.10.zip — 176 MB (all releases)

Extract it. Nothing else is needed — the ZIP carries adb, Git Bash and the prebuilt binaries.

Use

1. On the tablet (first time only): Settings → About tablet → tap Build number 7 times, then Settings → Developer options → turn on USB debugging.
2. Plug in the tablet over USB, keep the screen unlocked, and tap Allow when it asks about USB debugging.
3. Double-click ghostlock.bat.

It roots the tablet, installs KernelSU, NeoZygisk and Vector, and verifies each step. Takes a few minutes; the UI blinks once while Vector sets up. Internet is needed on the first run to download NeoZygisk and Vector.

Root is lost on reboot — run ghostlock.bat again to re-root.

Notes

• Root channels (FIFO, loopback shell) are unauthenticated. Device-owner use only.

Credits

• AnonymousUser369/GhostLockAdapt - ported src/kaslr_perf.c
• NebuSec/CyberMeowfia, x-spy/CVE-2026-43499-popsicle, YuKongA/ghostlock-app - GhostLock references
• tiann/KernelSU, JingMatrix/NeoZygisk, JingMatrix/Vector

License

This project: Apache-2.0, except the ported src/kaslr_perf.c.

• kernelsu.ko - GPL-2.0-only
• ksud, KernelSU-manager.apk - GPL-3.0-or-later