0xM0nCrush

0xM0nCrush A cross-version Windows process terminator. It loads a signed HONOR kernel driver MonProcessEX.sys, resolves the PID of every target process, and terminates it from kernel context through a single IOCTL. No kernel offsets, no PDB downloads, no build-specific shellcode - the technique...

ghostlock-aak-apk

GhostLock AAK Launcher CVE-2026-43499 · Linux kernel rtmutex stack Use-After-Free local privilege escalation LPE loader/trigger This repository is a security research and proof-of-concept PoC project , used to demonstrate and verify the trigger flow of the CVE-2026-43499 GhostLock vulnerability i...

cve-2026-43499-honor

CVE-2026-43499 GhostLock — Honor BVL-AN16 提权研究 针对 Honor Magic6 Pro BVL-AN16 的 CVE-2026-43499（GhostLock，rtmutex stack-UAF）提权研究与归档。...

Elysium-Vanguard-Sentinel-Audit

SENTINEL-ROOT-AUDIT: Honor Magic V2 Hypervisor Detection Suite ➲ Project Overview SENTINEL-ROOT-AUDIT is a professional-grade security suite designed to audit kernel integrity and detect hypervisor-level interventions on the Honor Magic V2 SM8550. While the core vulnerability CVE-2025-38352 allow...

cve-2026-43499-aak-an00

CVE-2026-43499 · 荣耀 WIN RT AAK-AN00 临时 Root 研究笔记 （全是deepseek写的，我啥也不懂） （又折腾了几天，进展为零，放弃了） （目前可以获取root，但非常不稳定，root后会断网，拔线会重启） （此仓库所有结论都只适用于荣耀 WIN RT，CVE-2026-43499漏洞，6.6.118-android15-8-gf17133276a57-abogki518694926-4k内核，不要扩散结论到临时root上，临时root可以持续并相对稳定运行） 设备 Bootloader 永久锁死 （ro.oemunlock.supported...

ghostlock-apk

GhostLock APK Standalone APK: CVE-2026-43499 GhostLock kernel privilege escalation + execution as Shizuku shell identity. Prerequisites Honor AAK-AN00 / MagicOS 10 / Linux 6.6.89 / 4KB page Shizuku installed and started via adb adb shell sh /sdcard/Android/data/moe.shizuku.privileged.api/start.sh...

GhostLock-H80GT

English | 中文 Honor 80 GT Privilege Escalation PoC: GhostLock CVE-2026-43499 A local privilege escalation exploit for the Honor 80 GT AGT-AN00 , CVE-2026-43499 — a use-after-free in the kernel rtmutex removewaiter path — plus a companion KernelSU kernel-module loading solution. In principle the bu...

ghostlock-honor-aak-probe

This repository does not have a README...

ghostlock-honor-aak

ghostlock-honor-aak GhostLock CVE-2026-43499 exploit adapted for Honor AAK-AN00 MagicOS 10, kernel 6.6.89-android15...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock-HonorFne Hono...

Exploit for Use After Free in Linux Linux_Kernel

Research on KernelSU Root during the Operation of Honor MagicP...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock — HONOR Magic 7 Lite / X9C 5G BRP-NX1 Port Port o...

Exploit for Use After Free in Linux Linux_Kernel

Honor X50 Privilege Escalation: GhostLock CVE-2026-43499 A...

honor-6.12.38-43499-research

CVE-2026-43499 Honor YLP-W00 6.12.38 PGO 権限昇格研究 研究状況：脆弱性は確認済みでトリガー可能、PI walk は成功しクラッシュしないが、完全な権限昇格チェーンは未実装。上流の更新を待機中。 本リポジトリは、Honor YLP-W00 タブレット（カーネル 6.12.38、+pgo+bolt+lto+mlgo）上で CVE-2026-43499 を利用した一時的な権限昇格の完全な研究過程を記録したものである。 一言結論 脆弱性トリガー成功（EDEADLK）、PI chain walk 成功（schedsetattr=0、クラッシュなし）。しかし...

CVE-2026-97561

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 Honor YLP-W00 6.12.38 PGO Privilege Escalatio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid walking the Namespace if startnode is NULL Although commit 0c9992315e73 “ACPICA: Avoid walking the ACPI Namespace if it is not there” fixed the issue when both startnode and acpigblrootnode were NULL, the Linux kern...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 · Honor WIN RT AAK-AN00 Temporary Root Resear...

EUVD-2026-70221

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function setcoursemodeprice at lms/djangoapps/instructor/views/instructordashboard.py:430 is decorated only with @loginrequired and performs no course-level permission check. An...

PT-2026-84817

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set course mode price at lms/djangoapps/instructor/views/instructor dashboard.py:430 is decorated only with @login required and performs no course-level permission chec...