psc

PortShellCrypter -- PSC This project - as well as its sister project crash - belongs to my anti-censorship tool-set that allows to setup fully working encrypted shells and TCP/UDP forwarding in hostile censoring environments. It is also useful for forensics to dump data from devices via UART or...

CVE-2026-98260

CVE-2026-98260 — posix-cpu-timers UAF Android LPE English | 简体中文 Vulnerability Item| Value ---|--- CVE| CVE-2026-98260 Type| LPE, use-after-free timerqueue rb-tree erase Target| Honor MagicPad3 Pro 13.3 YLP-W00 Android 16 Kernels| 6.12.38 MagicOS 10.0.0, 6.12.58 MagicOS 11.0.0.109 SELinux|...

CVE-2026-98260

CVE-2026-98260 Timer LPE CVE-2026-98260 POSIX CPU timer UAF 移植，支持情况见「内核支持」 两条链： timer：真实 cred 零写 → uid=0、u:r:shell:s0（shell 域 root，bset caps） timer fake：fake cred（full caps）→ 安装版 KernelSU libksud.so late-load 状态 路径| 结果 ---|--- real cred 零写 + setuid0 + exec sh| uid=0、u:r:shell:s0、ROOTSHELLOK fake...

cve-2026-64560-rmx6699

CVE-2026-64560 — realme RMX6699 Android 17 / COOS17 Temporary-root exploit for the realme RMX6699 Snapdragon 8 Elite / SM8750, kernel 6.6.118-android15-8-g9bc34d5b0c79. ⚠️ Experimental kernel exploit. It can panic/reboot the device or corrupt kernel state. Only run it on a device you own or are...

flawfinder

About This is "flawfinder" by David A. Wheeler. Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws. It can be a useful tool for examining software for vulnerabilities, and it can also serve as a simple introduction to static source code analysis tools...

CVE-2026-64560-Analysis

CVE-2026-64560 — Linux Kernel posix-cpu-timers non-leader exec race UAF Reproducer / PoC trigger verification : Linux & Android NDK This repository is intended solely for verifying patch status and for research/learning on your own test devices. It does not contain any privilege...

prague-CVE-2026-64560-OS4.0

Prague-KSU Obtain temporary root on the REDMI K90 Max codenameprague, OS4.0.0.14.XAACNXM using CVE-2026-64560, and load the KernelSU module. The vulnerability itself is a race in posix-cpu-timers between "non-leader thread exec" and "process-level CPU timer deletion", which causes a use-after-fre...

tetsuo-pulse

Socket Library Maturity Notice : This library is functional and well-tested but newly released. It is appropriate for development, internal tooling, and controlled environments. Production deployment with untrusted network input should wait until the codebase has accumulated several months of...

chronomaly

Chronomaly Chronomaly is a kernel exploit for the Android / Linux kernel using CVE-2025-38352. The exploit was written specifically for Linux kernel v5.10.157, but should work against all vulnerable v5.10.x kernels, as it does not require any specific kernel text offsets to work. I covered the...

lpe-study-notes

Kernel LPE study notes — the POSIX CPU timer bug A slow, from-zero walkthrough of CVE-2026-98260-ubuntu.c a Linux kernel local privilege escalation via a POSIX CPU timer use-after-free in exec. Written one chapter at a time, from first principles: processes and threads, syscalls, taskstruct /...

onionjuggler

OnionJuggler Feature-rich onion service manager for UNIX-like operating systems written in POSIX compliant shellscript OnionJuggler is a minimal requirement, portable collection of scripts and documentation to help the service operator juggle manage his onions. WARNING:do not trust this repo yet,...

rootkit

RootKit · Jailbreak Assistant Flutter + Shizuku ⚠️ Read this first: if you don't plan to root, upgrade your system right away This tool exploits the kernel vulnerability CVE-2026-64560 a use-after-free in posix-cpu-timers under an exec race. As long as the system is unpatched, any ordinary app can...

poc-CVE-2025-38352

🚀 poc-CVE-2025-38352 - Easy Download for a Security Tool 📥 Download Now 📖 Overview This application is a proof of concept for CVE-2025-38352. It demonstrates a vulnerability in the Linux kernel's POSIX CPU timers implementation. The September 2025 Android Bulletin notes that this vulnerability ha...

nmapAutomator

nmapAutomator A script you can run in the background! Summary The main goal for this script is to automate the process of enumeration & recon that is run every time, and instead focus our attention on real pentesting. This will ensure two things: 1. Automate nmap scans. 2. Always have some recon...

xring-CVE-2026-98260-OS4.0

XRING-KSU · CVE-2026-98260 在玄戒 O1 家族 （violin = Xiaomi Pad 7S Pro 12.5 / 25053RP5CC、jinghu = Xiaomi Pad 7 Ultra、dijun = Xiaomi 15S Pro）上一键取得 root：利用 CVE-2026-98260（exec 子系统的 POSIX timer UAF）拿到内核任意读写，落成 root + 宽容 SELinux，并按所选方案加载 KernelSU / SukiSU / KernelSU Next / 7kimisu 中的任一 LKM，打包成平板双栏 UI 的...

infinitylock-app

InfinityLock InfinityLock attempts to gain temporary root on the supported Vivo X200 Ultra PD2454 by exploiting CVE-2026-98260, then loads KernelSU. It requires Shizuku to run the exploit with shell access and the official KernelSU Manager to be installed for KernelSU's manager and ksud...

K80Pro-miro-CVE-2026-98260

CVE-2026-98260 — Android arm64 POSIX Timer UAF 红米k80 Pro OS 3.0.305.0 移植 非 leader 线程 execve 触发的 POSIX CPU timer UAF，从 uid=2000 拿到 uid=0 + 完整 capabilities（CapEff=0x1ffffffffff）。 ⚠️ 仅限自有设备的安全研究 ，使用前请读文末免责声明。 支持范围 项| 值 ---|--- 机型| Redmi K80 Pro miro 系统| HyperOS 3 / OS3.0.305 （OS3.0.304 理论可用，同一内核...

cve-2026-98260-nezha

CVE-2026-98260 · Xiaomi 17 Ultra nezha temporary root + KernelSU PoC 从一台已授权 ADB、bootloader 锁定、SELinux Enforcing 的小米 17 Ultra 出发， 利用 POSIX CPU timer 在 exec 中的 use-after-free 拿到当前开机周期内 的 uid=0 + 完整 capabilities，再用这个 root 把 KernelSU 模块 late-load 进内核， 得到 KSU 管理的 su。 This is temporary root : as soon a...

2022-LPE-UAF

2022-LPE-UAF Untested POC code Security researchers discovered 3 vulnerabilities in the Linux kernel that could allow a local attacker to elevate privileges and potentially execute malicious code. The proof-of-concept code is publicly available increasing the likelihood of exploitation in the wil...

2022-LPE-UAF

2022-LPE-UAF Untested POC code Security researchers discovered 3 vulnerabilities in the Linux kernel that could allow a local attacker to elevate privileges and potentially execute malicious code. The proof-of-concept code is publicly available increasing the likelihood of exploitation in the wil...