CVE-2026-43499

👻 CVE-2026-43499 — GhostLock 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros GhostLock is a high-severity Use-After-Free UAF vulnerability in the Linux Kernel rtmutex subsystem. The flaw originates from incorrect waiter cleanup during Priority Inheritance PI...

CVE-2026-43499

CVE-2026-43499 Exploitation Notes Severity: HIGH CVSS: 7.8 Impact: Confidentiality, Integrity, Availability Published: 2026-05-21 Technical Summary CVE-2026-43499 is a vulnerability within the Linux kernel, specifically affecting the rtmutex component, which is responsible for managing real-time...

Android-CVE-2026-43499

CVE-2026-43499 Detector Android app that detects the kernel vulnerability CVE-2026-43499 — a use-after-free in rtmutex triggered via futexrequeue. Vulnerability | ---|--- CVE| CVE-2026-43499 Type| Use-after-free Component| kernel/locking/rtmutex.c Trigger| futexrequeue → proxy-lock rollback in...

openvz-cve-patch-2026

GhostLock - CVE-2026-43499 backport patch for openVZ 7 CVE-2026-43499 backport patch for openVZ 7 kernel vzkernel-3.10.0-1160.129.1.ovz7.226.2 Since OpenVZ team didnt deploy patch for OpenVZ kernel yet with help of Claude i've created this one and it seems to work! ive tested it on two servers in...

F9360-CVE43499

SM-F9360 Galaxy Z Fold4 / q4q Bootloader-Unlock-Free KernelSU Root CVE-2026-43499 temporary root → LDPRELOAD channel bypasses DEFEX → non-LTO clang-12 build of kernelsu.ko → full su + KernelSU Manager functionality Status: ✅ Verified on real device on 2026-08-12 firmware F9360ZCSAIZF1, kernel...

Lenovo-TB365FC-GhostLock-CVE-2026-43499

GhostLock for Lenovo TB365FC Root for ZUXOS / Android 16 via CVE-2026-43499 rtmutex removewaiter use-after-free plus a DirtyPipe credential patch. Loads a KernelSU LKM without unlocking the bootloader or flashing. Root is lost on reboot. Firmware: ZUXOS 1.5.10.178 Kernel:...

pixel-ksu-root

pixel-ksu-root Root a stock, locked-bootloader Google Pixel from an unprivileged adb shell, using a kernel CVE — no unlock, no flash, no vendor help. A userspace-reachable kernel bug yields a short-lived read/write primitive. That primitive is spent late-loading a KernelSU module into the running...

CVE-2026-43499

CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free Bug removewaiter in kernel/locking/rtmutex.c is used by the slowlock paths but also for proxy-lock rollback in rtmutexstartproxylock when invoked from futexrequeue. In the proxy-lock case waiter::task is not current, but removewaiter incorrect...

ghostlock

GhostLock — Linux kernel rtmutex/futex stack-UAF tracking site Source for the GhostLock patch-status tracker: a single-page site recording which distributions have shipped a fix for the rtmutex/futex stack use-after-free in the Linux kernel. Tracking concluded 2026-08-06 : every tracked kernel...

CVE-2026-43499-poc

Weaponisation research for CVE-2026-43499 ghostlock. the rtmutex removewater proxy path bug that leaves a tasks piblockedon dangling into its own popped kernel stack frame. The bug class and original exploit strategy credit to nebusec their write-up here everything in this repo is my own...

CVE-2026-43499-aristotle

CVE-2026-43499 — aristotle au/KDDI Xiaomi XIG04 Local privilege escalation tmp-root for the au/KDDI Xiaomi "aristotle" XIG04 on Android 12 , via CVE-2026-43499. It is a device-owner rooting primitive: it roots your own phone e.g. to re-enable ADB when developer options are unreachable. This is an...

CVE-2026-43499

CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free Bug removewaiter in kernel/locking/rtmutex.c is used by the slowlock paths but also for proxy-lock rollback in rtmutexstartproxylock when invoked from futexrequeue. In the proxy-lock case waiter::task is not current, but removewaiter incorrect...

Logitech-G-Cloud-GhostLock-CVE-2026-43499

Logitech G Cloud · GhostLock CVE-2026-43499 Root Attempt Logitech G Cloud — CVE-2026-43499 GhostLock Root Attempt ⚠️ For research and defensive purposes only All content in this repository is generated by DeepSeek AI , for security research, vulnerability analysis, and defensive security assessmen...

ghostlock-oppo-watch3pro

GhostLock CVE-2026-43499 — OPPO Watch 3 Pro Complete Research Case Complete exploitation research on CVE-2026-43499 GhostLock, rtmutex/futex-PI stack UAF on the OPPO Watch 3 Pro OWW211, ColorOS Watch China version, Android 11, ARM32. Final conclusion: the chain-walk write mechanism crashes on...

ghostlock-aak-apk

GhostLock AAK Launcher CVE-2026-43499 · Linux kernel rtmutex stack Use-After-Free local privilege escalation LPE loader/trigger This repository is a security research and proof-of-concept PoC project , used to demonstrate and verify the trigger flow of the CVE-2026-43499 GhostLock vulnerability i...

humane-aipin-ghostlock

GhostLock for Humane AI Pin GhostLock for Humane AI Pin is an open-source, boot-scoped root proof of concept for one exact retail firmware build. It exercises CVE-2026-43499, a Linux rtmutex use-after-free, from an ordinary authorized ADB shell. The runner is deliberately narrow. It checks the...

ghostlock-cve-2026-43499-4.19-k40

GhostLock — CVE-2026-43499 PoC Qualcomm 4.19 kernel Local privilege escalation exploiting CVE-2026-43499 — an rtmutex removewaiter bug that leaves a struct rtmutexwaiter dangling on the waiter's kernel stack kernel/locking/rtmutex.c, CWE-416 use-after-free. Adapted from NebuSec/CyberMeowfia...

ghostlock-cve-2026-43499-4.19-k40

GhostLock — CVE-2026-43499 PoC Qualcomm 4.19 kernel Local privilege escalation exploiting CVE-2026-43499 — an rtmutex removewaiter bug that leaves a struct rtmutexwaiter dangling on the waiter's kernel stack kernel/locking/rtmutex.c, CWE-416 use-after-free. Adapted from NebuSec/CyberMeowfia...

GhostLock-GOT-W29

GhostLock GOT-W29 HUAWEI MatePad Pro 11（GOT-W29，SM8250 / Snapdragon 870，HarmonyOS 4.x， kernel 4.19.157-perf+）的 CVE-2026-43499 提权适配。 Current status: A 路线真机完成：合法 private root cred，SELinux 保持 u:r:shell:s0 持久 root broker：@glsu 完整 PTY root shell：Ctrl-C、方向键、后台作业控制均可用 arbitrary read 使用独立 random/uuid...

ghostlock-selinux-disabler

GhostLock SELinux Disabler Write-1-only extraction of JoinChang/ghostlock-oneplus for CVE-2026-43499. It disables SELinux enforcing on supported, vulnerable OnePlus kernels with a locked bootloader, and does nothing else: no cred overwrite, no root shell, no KernelSU, no bootstrap, and no KASLR...