CVE-2026-43499-root-KernelSU

A local privilege escalation adaptation based on kernel vulnerability CVE-2026-43499, with embedded KernelSU integrated. It compiles to produce preload.so; upon successful exploitation, KernelSU will be started in late-load mode (jailbreak mode). Supports generating target.h from (xbl_config.img / vendor_boot.img) + boot.img.

Local privilege escalation adaptation based on a kernel vulnerability, integrating embedded KernelSU. Compiles and generates preload.so; upon successful exploitation, KernelSU will be started in late-load mode (jailbreak mode). Supports generating target.h from (xbl_config.img / vendor_boot.img) + boot.img. or other way

Referenced projects:

• Linuxoid-cn/CVE-2026-43499-Poc-Analysis
• x-spy/CVE-2026-43499-popsicle
• Colorful-glassblock/duchamp-root

[!IMPORTANT] The unauthorized exploitation of vulnerabilities to damage, compromise, or gain access to computer systems is prohibited by law. This project is provided strictly for research, educational, and learning purposes, and may only be used in systems and environments for which prior authorization has been granted. Any use of this project is undertaken at the user's own risk. The authors and contributors assume no liability for any misuse of this project or for any damages, losses, or legal consequences resulting from its use.

Disclaimer: Unauthorized exploitation of vulnerabilities to damage, intrude into, or gain unauthorized access to computer systems may violate applicable laws and regulations. This project is strictly limited to security research, learning, and testing in systems and environments for which lawful authorization has been obtained. Any direct or indirect losses, legal liability, and other consequences arising from the use, misuse, or modification of this project shall be borne solely by the user; the project authors and contributors assume no responsibility.

Affected Scope

If your kernel version is {Linux Kernel}, it falls within the affected scope of this vulnerability

• Linux Kernel < commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349

• 2.6.39 <= {Linux Kernel} < 6.1.175

• 6.2 <= {Linux Kernel} < 6.6.140

• 6.7 <= {Linux Kernel} < 6.12.86

• 6.13 <= {Linux Kernel} < 6.18.27

• 6.19 <= {Linux Kernel} < 7.0.4

Current Status

Directory Structure

.
├── Makefile
├── build/
│   └── embed/
│       └── ksud                 # 被嵌入 preload.so 的 KernelSU userspace binary
├── tools/
│   ├── generate_target.py       # 本仓库统一 target.h 生成入口
│   └── vendor/                  # 从父目录同步的原始生成辅助脚本
└── src/
    ├── main.c                   # exploit 主流程
    ├── preload.c                # LD_PRELOAD constructor + ksud 写出/启动
    ├── root.c                   # cred/seccomp/SELinux/root patch
    ├── slide.c                  # pselect KASLR slide leak
    ├── fops.c                   # pselect/FOPS route
    ├── pipe.c                   # pipe-buffer phys R/W primitive
    ├── ksud_blob.S              # .incbin build/embed/ksud
    ├── kernelsnitch/            # KernelSnitch helpers
    └── targets/
        ├── rodin/
        ├── beryl/
        └── ...

Build

Dependencies

• Linux host
• Android NDK
  • Default path: ~/android-ndk-r29
  • Or set: ANDROID_NDK_HOME / ANDROID_NDK_ROOT / NDK_ROOT
• make
• git

Build

make PROJECT=<target> -j$(nproc)

Output:

build/<target>/bin/preload.so

List Available Targets

make list-projects

Generating target.h

This repository already includes a unified target generation script:

tools/generate_target.py
tools/vendor/generate_target.py
tools/vendor/generate_target_2.py
tools/vendor/detect_offset.py

tools/generate_target.py is the entry-point script. It references and wraps all the target generation flows in the parent directory, and finally outputs a complete src/targets/<project>/target.h adapted to this repository's source code.

The script does not strictly validate CONFIG_DEBUG_INFO_BTF=y in IKCONFIG. If struct field offsets or the percpu entry_task layout cannot be verified, it prints a warning and continues generating.

If the image has no usable BTF at all, for example:

有效 vmlinux BTF 候选不唯一: []

the generator will enter the no-BTF fallback:

• Continue recovering function/global object symbol offsets from the kallsyms of the current boot.img;
• Struct field/layout macros that cannot be recovered from BTF inherit from the template target, with the default template being rodin;
• A warning is written at the top of the generated header, indicating without BTF and the template used;
• This kind of header is guaranteed to be as compilable as possible, but runtime reliability requires verification on real hardware.

You can specify a fallback template:

tools/generate_target.py --project <project> --boot boot.img --profile profile.json --template-target rodin
# 或
TARGET_TEMPLATE=rodin tools/generate_target.py --project <project> --boot boot.img --profile profile.json

1. Generate from boot.img + profile JSON

make generate-target PROJECT=<project> BOOT=/path/to/boot.img PROFILE=/path/to/profile.json

Writes to by default:

src/targets/<project>/target.h

You can also invoke the script directly:

tools/generate_target.py --project <project> --boot /path/to/boot.img --profile /path/to/profile.json

profile.json needs to contain physical address information, for example:

{
  "p0_phys_offset": "0x40000000",
  "p0_kernel_phys_load": "0x40000000"
}

2. Detect profile from an already-rooted ADB device

Generate the profile only:

make detect-profile PROFILE_OUT=profile.json

Detect the profile and immediately generate the target:

tools/generate_target.py --project <project> --boot /path/to/boot.img \
  --detect-adb-and-generate --profile-out profile.json

3. Generate from (xbl_config.img / vendor_boot.img) + boot.img

The script also exposes other entry points supported by the parent-directory generator:

tools/generate_target.py --project <project> --boot boot.img --xbl-config xbl_config.img

tools/generate_target.py --project <project> --boot boot.img --mtk-vendor-boot vendor_boot.img

tools/generate_target.py --project <project> --boot boot.img --mtk-partitions /path/to/partitions

Example

make generate-target PROJECT=rodin BOOT=../rodin/boot_a PROFILE=../profile.json
make generate-target PROJECT=beryl BOOT=../beryl/boot.img PROFILE=../profile.json

A successful output looks like:

生成成功: .../src/targets/<project>/target.h
kernel SHA-256: <sha256>
target macros: 168

rodin keeps the following value verified on real hardware by default:

#define MM_STRUCT_SZ 0x500

To override:

tools/generate_target.py --project rodin --boot boot.img --profile profile.json --mm-struct-sz 0x...

Adding a New Target

It is recommended to generate from a matching boot image and profile:

make generate-target PROJECT=<project> BOOT=/path/to/boot.img PROFILE=/path/to/profile.json
make PROJECT=<project> -j$(nproc)

A complete target header will contain:

• direct map / physical profile constants
• KASLR slide object offsets
• task / cred / SELinux offsets
• pipe / fops / configfs offsets
• pselect layout values, e.g. PSELECT_WAITER_WORD_SHIFT
• MM_STRUCT_SZ and KernelSnitch tuning values

Running

The current source already has the defaults written in. For normal operation, you only need to set LD_PRELOAD and execute any program (recommended: toybox id).

adb push build/rodin/bin/preload.so /data/local/tmp/preload.so
adb shell 'chmod 755 /data/local/tmp/preload.so'
adb shell 'LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'

Default Runtime Parameters

The current default configuration is as follows:

The ksud command actually executed by default is:

/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu

These environment variables can still be overridden at runtime, for example:

adb shell 'KSUD_PACKAGE=com.example.manager LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'

To reuse an already-written ksud:

adb shell 'KSUD_SKIP_WRITE=1 LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'

Cleanup

make clean

make clean preserves build/embed/ksud because src/ksud_blob.S embeds it via:

.incbin "build/embed/ksud"

If manual cleanup causes build/embed/ksud to be lost, you can restore it:

git checkout -- build/embed/ksud

FAQ

.incbin "build/embed/ksud" not found

Restore the built-in payload and rebuild:

git checkout -- build/embed/ksud
make PROJECT=rodin -j$(nproc)

FOPS route returns success=0

rodin expects the legacy/simple pselect layout:

pselect fdset simple layout shift=0
pselect returned attempt=1 ret=9 ... success=1

If the device state has been polluted by failed attempts, reboot and try again:

adb reboot

F_SETPIPE_SZ returns EPERM

This is usually a state issue caused by failed/residual attempts; rebooting is the fastest way to clean it up:

adb reboot

ksud starts but /proc/modules has no KernelSU

Check the logs:

adb shell 'cat /data/local/tmp/ksud.log /data/local/tmp/ksud.preload.log 2>/dev/null || true'

If necessary, run it manually in a root shell:

/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu

License

GPL-3.0. See LICENSE.