69 matches found
ghostlock-sabrina
GhostLock Sabrina 针对 Chromecast with Google TV （sabrina）的 root 漏洞利用，通过 CVE-2026-43499 实现——Linux 内核 futex PI（优先级继承）子系统中的一个释放后使用漏洞。 在运行 Android 14、内核版本 5.15.170（PGO+BOLT+LTO，clang 17）的锁定引导加载程序 设备上获取 root 权限。 漏洞详情 GhostLock 利用了 rtmutexstartproxylock 中 -EDEADLK 回滚路径调用的 removewaiter 中的一个缺陷。该函数清除的是...
ghostlock-emerald
GhostLock para POCO M6 Pro emerald GhostLock CVE-2026-43499 es un use-after-free de 15 años de antigüedad en el código de herencia de prioridad de futex del kernel de Linux que permite a cualquier usuario local obtener root. Este proyecto lo utiliza para rootear el POCO M6 Pro MediaTek Helio G99...
CVE-2026-43499
👻 CVE-2026-43499 — GhostLock 15年前のGhostLockの脆弱性がほとんどのLinuxディストリビューションでルート権限取得とコンテナエスケープを可能にする GhostLock は、Linuxカーネルのrtmutex サブシステムにおける高深刻度のUse-After-Free UAF脆弱性です。この欠陥は、Priority Inheritance PI処理中の誤ったウェイタークリーンアップに起因し、カーネルメモリの破壊、ローカル権限昇格、またはサービス拒否を引き起こす可能性があります。 📑 目次 概要 技術概要 根本原因 攻撃フロー 影響 影響を受けるバージ...
ghostlock-oneplus
GhostLock — 锁定引导加载程序越狱 针对锁定引导加载程序的 Android 设备内核漏洞利用。无需解锁引导加载程序或修改引导镜像即可实现临时 root + KernelSU 安装。运行时自动检测内核版本，并配备多设备偏移表。 漏洞 CVE-2026-43499 — Futex PI（优先级继承）释放后使用 影响 Linux 内核 5.7 7.1。已在稳定版 6.1.175、6.6.140、6.12.86 中修复。截至 2026 年 9 月，大多数 Android 设备仍未打补丁。 pselect6 系统调用将 fdset 数据复制到内核栈上。当与 futex PI...
GhostLock-OPPO-PCKM00
GhostLock — OPPO PCKM00 4.14.180 PoC CVE-2026-43499 GhostLock — Linux 内核 futex 优先级继承 释放后使用本地提权 PoC，已移植到 OPPO PCKM00 OP4A57, SM6150, Android 11, kernel 4.14.180-perf+ 。 DISCLAIMER / 免责声明 本项目仅用于授权的安全研究与教育目的 。请勿在非本人所有或未获明确授权的设备上使用。运行利用可能导致内核崩溃，作者不承担任何滥用或损失的责任。 本项目仅用于授权的安全研究与教育目的...
pixel-ksu-root
pixel-ksu-root Root a stock, locked-bootloader Google Pixel from an unprivileged adb shell, using a kernel CVE — no unlock, no flash, no vendor help. A userspace-reachable CVE gives a short-lived kernel read/write primitive, which late-loads a KernelSU module kernelsu.ko into the running GKI...
CVE-2026-80778
In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mmusers reference. Nevertheless, attachtopiowner currently accepts an owner from a different address space and copies th...
Exploit for Use After Free in Linux Linux_Kernel
GhostLock — OPPO PCKM00 4.14.180 PoC CVE-2026-43499 Ghos...
Exploit for Use After Free in Linux Linux_Kernel
CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free Bug...
kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
A flaw was found in the Linux kernel's futex Fast Userspace Mutex requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance PI futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the removewaiter function during a self-deadlock...
kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
A flaw was found in the Linux kernel's futex Fast Userspace Mutex requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance PI futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the removewaiter function during a self-deadlock...
kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
A flaw was found in the Linux kernel's futex Fast Userspace Mutex requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance PI futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the removewaiter function during a self-deadlock...
kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
A flaw was found in the Linux kernel's futex Fast Userspace Mutex requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance PI futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the removewaiter function during a self-deadlock...
kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
A flaw was found in the Linux kernel's futex Fast Userspace Mutex requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance PI futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the removewaiter function during a self-deadlock...
kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
A flaw was found in the Linux kernel's futex Fast Userspace Mutex requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance PI futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the removewaiter function during a self-deadlock...
kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
A flaw was found in the Linux kernel's futex Fast Userspace Mutex requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance PI futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the removewaiter function during a self-deadlock...
kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
A flaw was found in the Linux kernel's futex Fast Userspace Mutex requeue mechanism. When a non-top waiter attempts to requeue a Priority Inheritance PI futex it already owns, a NULL pointer dereference can occur. This issue, specifically within the removewaiter function during a self-deadlock...
SUSE CVE-2026-53327
In the Linux kernel, the following vulnerability has been resolved: debugobjects: Do not fillpool if piblockedon On RT enabled kernels, fillpool ends up calling rtlocklock, which asserts if current::piblockedon is set, because a task can obviously only block on one lock as otherwise the priority...
CVE-2026-53327
A flaw was found in the Linux kernel's debugobjects functionality. On systems with Real-Time RT enabled kernels, the fillpool function can lead to a system assertion if a task is already blocked on a lock, causing corruption of the priority inheritance chain. This issue can result in a Denial of...
CVE-2026-53327
In the Linux kernel, the following vulnerability has been resolved: debugobjects: Do not fillpool if piblockedon On RT enabled kernels, fillpool ends up calling rtlocklock, which asserts if current::piblockedon is set, because a task can obviously only block on one lock as otherwise the priority...