GhostLock AAK Launcher
CVE-2026-43499 · Linux kernel rtmutex stack Use-After-Free local privilege escalation (LPE) loader/trigger
This repository is a security research and proof-of-concept (PoC) project, used to demonstrate and verify the trigger flow of the CVE-2026-43499 (GhostLock) vulnerability in a controlled test environment.
Project Overview
This is an Android application (APK) "loader/trigger" designed to work with an external preload.so.
- Target vulnerability: CVE-2026-43499 (Linux kernel kernel/locking/rtmutex.c, stack UAF)
- Purpose: Obtain shell privileges (uid 2000) via Shizuku, write the external preload.so to /data/local/tmp/preload.so, and inject it into /system/bin/sh via LD_PRELOAD, triggering the preload.so constructor run_exploit() to execute the full exploit chain.
- Verification target: Honor AAK-AN00 · MagicOS 10 / Android 15 · kernel 6.6.89-android15-8
Technical Highlights
- Correctly selects the shell privilege (uid 2000) trigger environment, avoiding interception of futex PI operations by the untrusted_app sandbox Seccomp=2
- LD_PRELOAD injection, no need to modify host process code
- Dual-thread parallel reading of stdout/stderr to prevent pipe deadlock
- Follows the official Shizuku UserService pattern, with real-time log callbacks
For a more detailed explanation of the vulnerability principle and exploit chain, see EXPLOIT_CN.md.
Current Status (Important)
⚠️ This repository is currently in an "insufficiently verified" state.
- This project has not undergone systematic, extensive device testing. Whether the vulnerability trigger can stably succeed on a specific device/firmware/kernel version is currently unknown (Unknown / Unverified).
- The trigger success rate is affected by various engineering factors, such as:
- KASLR slide brute force: address randomization enumeration may fail
- Hardcoded offsets: the offset table depends on a specific firmware version (6.6.89-android15-8); different vendor patches and different kernel builds may vary
- Vendor security patches: if the device has already applied the relevant fix, the vulnerability may have been mitigated
- Therefore, this repository does not guarantee reproduction or successful exploitation on any device.
- Please verify on a controlled, isolated test device, and never use it in a production environment or on someone else's device.
Status at a Glance
| Item | Status |
|---|
| Vulnerability authenticity (CVE-2026-43499) | Authoritatively confirmed by NVD |
| Source code design principle | Logically consistent, engineering implementation standard |
| Device-tested success rate | Unknown / Unverified |
| Multi-firmware compatibility | Unverified (depends on hardcoded offsets) |
| Can it escalate privileges on any device | Not guaranteed |
Usage Instructions
For use only in authorized, controlled research environments.
- Install and launch Shizuku (v11+)
- Install this APK, tap "Request Shizuku Permission"
- Select the preload.so file to inject
- Tap "Run Exploit" and observe the log output
See the debugging observation point table in EXPLOIT_CN.md for details.
Disclaimer
This software is provided "AS IS", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and noninfringement.
- This repository is intended solely for security research, vulnerability analysis, and educational purposes.
- Users should ensure they use this software within the scope of legal authorization, and bear all risks and legal liabilities arising from the use of this software themselves.
- The author is not responsible for any direct, indirect, incidental, or consequential damages caused by the use of this software (including but not limited to device damage, data loss, system instability, illegal tampering of accounts or privileges, legal disputes, etc.).
- This software must not be used for any illegal purposes, including but not limited to unauthorized access, malicious attacks, data theft, or destruction of others' systems.
- Users must comply with all applicable laws and regulations of their location and the jurisdiction to which the target system belongs.
By downloading, using, or distributing this software, you indicate that you have read, understood, and agreed to all terms of this disclaimer.
Legal Notice
1. Dual-Use Technology
This repository contains vulnerability exploitation-related code, which is dual-use technology that can serve legitimate security research and defense, but may also be misused for attacks. The distribution of such technology should follow the principles of Responsible Disclosure.
2. Vulnerability Disclosure Coordination
- This vulnerability has been assigned the identifier CVE-2026-43499, with the fix commit: rtmutex: Use waiter::task instead of current in remove_waiter().
- It is recommended to report to the vendor/kernel community through official channels first, and to follow official security advisories to promptly update affected systems.
3. Compliance and Jurisdiction
- Different countries and regions have different legal provisions regarding the distribution and use of exploit code and penetration testing tools (for example, the Cybersecurity Law, Data Security Law, and Regulations on the Protection of Computer Information System Security in some jurisdictions, as well as criminal/civil provisions on unauthorized access in various countries).
- Before using or distributing this software, be sure to confirm the relevant regulations in your jurisdiction. Illegal use or dissemination may constitute a criminal offense.
4. Authorization Prerequisite
- Testing is only permitted on systems/devices that you legally own or have written authorization for.
- Unauthorized testing may violate the law and constitute an infringement of the rights and interests of others.
License
This project is open-sourced under the GNU General Public License v3.0 (GPLv3). See LICENSE for details.
Copyright (C) 2026 oopnv70-lab
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
Third-Party Resource Notice
The application icon (launcher icon) of this project uses open-source assets:
For the complete source of the icon, the license text, and its compatibility with this repository's GPLv3, see THIRD_PARTY_NOTICES.md.
Security and Compliance Reminder
- Publicly releasing such vulnerability exploitation-related code carries the risk of misuse, reporting, or takedown; please assess before deciding on the scope of distribution.
- It is recommended to continuously follow the GitHub Community Guidelines and security research-related policies.
- Do not use this repository for any malicious activity.
oopnv70-lab/ghostlock-aak-apk
