8 matches found
CVE-2026-43499-warhol-root
warhol-root CVE-2026-43499 IonStack local privilege escalation, ported to the Xiaomi 17T Pro warhol — MediaTek MT6993, Android 16. GKI 6.12 / android16 only. The waiter overlay, the pselect stack layout and every struct offset are pinned to that branch, so nothing here transfers to 6.6, 6.1 or 5....
CVE-2026-43499-S25U
CVE-2026-43499 PoC for Galaxy S25 Ultra Device-specific proof of concept for CVE-2026-43499 on the Korean Samsung Galaxy S25 Ultra. Supported target Model: SM-S938N Codename: pa3q Android: 16 / API 36 Build: S938NKSUACZF1 Display ID: BP4A.251205.006.S938NKSUACZF1 Fingerprint:...
CVE-2026-43499-S26
CVE-2026-43499 — Android GKI 6.12 pselect / configfs kernel exploit A Linux kernel exploit for the Android GKI 6.12 line Samsung and Pixel devices targeting CVE-2026-43499 : a buggy removewaiter rollback in rtmutexstartproxylock that uses current instead of waiter::task, leaving a waiter's...
ghostlock-a17
GhostLock — CVE-2026-43499 on Samsung Galaxy A17 Full user-to-root exploit chain for CVE-2026-43499 "GhostLock" on the Samsung Galaxy A17 SM-A175F , running Android 16 / GKI 6.12. The chain starts from the public GhostLock primitives and ends with a usermode helper executing as: uid=0root gid=0ro...
Exploit for Use After Free in Linux Linux_Kernel
GhostLock CVE-2026-43499 for the Galaxy S26 CVE-2026-43499...
CVE-2026-43499-S26
CVE-2026-43499 — Android GKI 6.12 pselect / configfs 内核漏洞利用 一个针对 Android GKI 6.12 系列（三星和 Pixel 设备）的 Linux 内核漏洞利用，目标是 CVE-2026-43499 ：rtmutexstartproxylock 中 removewaiter 回滚存在缺陷，使用 current 而非 waiter::task，导致 waiter 的 piblockedon 指向其（随后被弹出的）内核栈 rtmutexwaiter。结合 pselect fdset 栈覆写和消费者线程 schedsetattr...