GhostLock-for-OnePlus

GhostLock — OnePlus Kernel exploit targeting locked-bootloader OnePlus devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Table of Contents Vulnerability Overview Supported Devices...

GhostLock-GOT-W29

CVE-2026-43499 GhostLock — HUAWEI MatePad Pro 11 GOT-W29 Privilege escalation research on CVE-2026-43499 rtmutex/futex-PI stack UAF, "GhostLock" for the GOT-W29 HarmonyOS 4.0, kernel 4.19.157-perf+. Final Conclusions 1. The vulnerability is real and triggerable : a value-holding PI cycle makes...

oppo-ghostlock

oppo-ghostlock GhostLock CVE-2026-43499 — OPPO Find N2 Linux Kernel Privilege Escalation Research Project Overview GhostLock CVE-2026-43499 is a kernel stack UAF vulnerability affecting Linux 2.6.39 through 7.1-rc1, triggered via a FUTEXCMPREQUEUEPI race condition. This project ports the x8664...

Vulnerability_PoC

The PoC/Exploit of some interesting vulnerabilities Author: Vulnerability Research Team of Numen Cyber Labs 1. TCP/IP RCE Vulnerability CVE-2022–34718 PoC Restoration and Analysis...

CVE-2022-41218

Introduction This vulnerability is a race condition vulnerability that occurs in drivers/media/dvb-core/dmxdev.c. Therefore, a race condition may occur in the usb device driver using this dmxdev. This vulnerability could be used to trigger 3 UAFs. Vulnerability 1. vmalloc UAF write First, the...

UnPlus

unplus CVE-2026-43499 Futex PI UAF kernel arbitrary-address-write exploit core logic code, used to bypass SELinux and gain root. This repository only contains the core exploit logic source src/ and the single-binary packager wrapper/. src/target.h is a template ; you must fill in parameters for...

CyberMeowfia

Website: nebusec.ai · Twitter @nebusecurity · Bug list 885+ IonStack followup, follow https://github.com/NebuSec/CyberMeowfia/issues/44 Latest research IonStack part II : GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Linux Kernel 📖 Writeup · 🐦 Twitter Longinus : ...

CVE-2026-43499-armv7

CVE-2026-43499 GhostLock — ARM32 Huawei Watch 4 Pro Linux kernel privilege escalation exploit attempt based on CVE-2026-43499 GhostLock — Huawei Watch 4 Pro MDS-AL00, armv7l Project Overview This project is a GhostLock kernel vulnerability exploit attempt targeting the Huawei Watch 4 Pro MDS-AL00...

GhostLock-for-OnePlus15T

GhostLock — OnePlus 15T Kernel exploit targeting locked-bootloader OnePlus 15T devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Modified from the originalGhostLock-for-OnePlus...

GhostLock

GhostLock - CVE-2026-43499 Local Privilege Escalation Exploit Vulnerability Overview CVE ID: CVE-2026-43499 Vulnerability Type: futex PI priority inheritance stack UAF Use-After-Free Affected Range: Linux kernel 6.1 6.12 Android GKI Exploitation Impact: Local privilege escalation + SELinux disabl...

SUSE-SU-2026:4415-1 Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.44 fixes various security issues: The following security issues were fixed: - CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. - CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283...

Exploit for CVE-2026-64560

Redmi 14C “pond” – CVE-2026-64560 Migration Kit Global Rele...

RootMyVivo-Exploit

RMV Exploit —— 面向 vivo / iQOO 的 CVE-2026-43499 boxiaolanya2008/CVE-2026-43499-Neo11Plus 的分支，为 RootMyVivo 重新整理。砍掉了所有拿到 root 之后会把手机搞坏的东西，漏洞利用核心保持经过验证的时序。 Русский · English 目标 目录| 设备| 内核| 偏移来源 ---|---|---|--- PD2520-BP2A.250605.031.A3| iQOO Neo 11| 6.6.89| 自己 boot.img 的 kallsyms+BTF，真机验证...

asus-i005-cve-2026-43499

asus-i005-cve-2026-43499 CVE-2026-43499 GhostLock 在 ASUS ROG Phone 5S ASUSI005 上的适配研究。 结论：漏洞触发与栈回收完整验证；提权链因栈覆盖深度不足而未完成。 具体地： Stage 01.6 全部验证成功（触发、栈回收、栈地址泄漏） Stage 2 的写原语需要覆盖 waiter+0x28..0x40（pitreeentry.rbleft 和 lock） pselect nfds=320 只覆盖到 waiter+0x27 未找到覆盖更深的栈回收载体（已穷尽 40+ 个候选 syscall） i005 的所有...

pixel-ksu-root

pixel-ksu-root 从非特权 adb shell 出发，利用一个内核 CVE 对一台原厂、锁定 bootloader 的 Google Pixel 进行 root——无需解锁、无需刷机、无需厂商协助。 一个用户态可达的内核缺陷提供了短暂的读/写原语。该原语被用于将 KernelSU 模块延迟加载进正在运行的 GKI 内核，随后 root 权限被移交给已安装的任意 KernelSU 管理器。不写入任何分区，因此重启即为卸载。一切都在主机上通过 adb 经由单个可执行文件 ./pixel-ksu-root 运行。 状态 CVE| 缺陷| 当前进展 ---|---|---...

root-s24-e1s

Root S24 e1s / S921BXXSDCZB2 在 Galaxy S24 SM-S921B 固件 S921BXXSDCZB2（内核 6.1.138-android14-11）上实现每次启动的本地 root，然后延迟加载 KernelSU Next ，使 com.rifsxd.ksunext 报告为 Working LKM。 与 Root My Galaxy 无关联。无 GitHub payload 源、无多设备目录。仅针对单一固件，捆绑 payload。请仅在你拥有的设备上使用。 下载 从 Releases 安装 APK。 KernelSU Next 管理器（必需）： v3.3...

ghostlock-a17

GhostLock — CVE-2026-43499 on Samsung Galaxy A17 Full user-to-root exploit chain for CVE-2026-43499 "GhostLock" on the Samsung Galaxy A17 SM-A175F , running Android 16 / GKI 6.12. The chain starts from the public GhostLock primitives and ends with a usermode helper executing as: uid=0root gid=0ro...

ghostlock-cve-2026-43499

CVE-2026-43499 GhostLock — ARM32 Kernel Privilege Escalation Research Linux kernel futex PI rtmutex Use-After-Free vulnerability research and exploit development targeting Huawei Watch 4 Pro MDS-AL00 , Snapdragon SW5100, armv7l, kernel 5.4.210. Vulnerability removewaiter in kernel/locking/rtmutex...

ghostlock-cve-2026-43499-4.19-k40

GhostLock — CVE-2026-43499 PoC Qualcomm 4.19 kernel Local privilege escalation exploiting CVE-2026-43499 — an rtmutex removewaiter bug that leaves a struct rtmutexwaiter dangling on the waiter's kernel stack kernel/locking/rtmutex.c, CWE-416 use-after-free. Adapted from NebuSec/CyberMeowfia...

AlmaLinux 9 : kernel (ALSA-2026:72623)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:72623 advisory. kernel: ext4: fix e4b bitmap inconsistency reports CVE-2026-45942 kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGESIZE CVE-2026-4632...