xring-CVE-2026-98260-OS4.0

XRING-KSU · CVE-2026-98260 在玄戒 O1 家族 （violin = Xiaomi Pad 7S Pro 12.5 / 25053RP5CC、jinghu = Xiaomi Pad 7 Ultra、dijun = Xiaomi 15S Pro）上一键取得 root：利用 CVE-2026-98260（exec 子系统的 POSIX timer UAF）拿到内核任意读写，落成 root + 宽容 SELinux，并按所选方案加载 KernelSU / SukiSU / KernelSU Next / 7kimisu 中的任一 LKM，打包成平板双栏 UI 的...

K80Pro-miro-CVE-2026-98260

CVE-2026-98260 — Android arm64 POSIX Timer UAF 红米k80 Pro OS 3.0.305.0 移植 非 leader 线程 execve 触发的 POSIX CPU timer UAF，从 uid=2000 拿到 uid=0 + 完整 capabilities（CapEff=0x1ffffffffff）。 ⚠️ 仅限自有设备的安全研究 ，使用前请读文末免责声明。 支持范围 项| 值 ---|--- 机型| Redmi K80 Pro miro 系统| HyperOS 3 / OS3.0.305 （OS3.0.304 理论可用，同一内核...

CVE-2026-98260-popsicle-android

CVE-2026-98260 · Android 17 / popsicle Local Privilege Escalation Port An Android AArch64 exploit chain built for a precise kernel build : starting from an ordinary ADB shell, it sequentially verifies SELinux Permissive, UID/GID 0, and full Linux capabilities, and provides a root shell service...

InfinityCore-Android-CVE-2026-98260

InfinityCore Android — CVE-2026-98260 Timer Chinese Overview ARM64 implementation of the Infinity Core series Timer subsystem vulnerability, with the target kernel form being the 7.0 series same source code structure as Ubuntu 26.04 7.0.0-30-generic. This repository implements the complete trigge...

Relapse-Exploit

PS5 Relapse Exploit Supported firmware: 7.00 through 13.60. Usage The default payloads are stored in payloads/ after a successful run, the ELF loader listens on port 9021. Stability notes Webkit may need several attempts, reload the page if the browser stalls. The kernel exploit may hang or panic...

qemu-nvme-sgl-bar

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · qemu-nvme-sgl-bar qemu-nvme-sgl-bar QEMU v11.1.2 4fc49f46dc95d4a27de2509e7fceb2931e91faeb - NVMe Class: UAF incomplete BAR0 deny-list; spanning SGL DMA into MMIO. Reach: Local guest. nvmemapaddr is the leftover of...

CyberMeowfia

Website: nebusec.ai · Twitter @nebusecurity · Bug list 885+ IonStack followup, follow https://github.com/NebuSec/CyberMeowfia/issues/44 Latest research IonStack part II : GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Linux Kernel 📖 Writeup · 🐦 Twitter Longinus : ...

prague-CVE-2026-98260-OS4.0

KAIROS-KSU · CVE-2026-98260 One-click root on REDMI K90 Max prague / 2604FRK1EC : exploit CVE-2026-98260 a POSIX CPU timer UAF in the exec subsystem to gain arbitrary kernel read/write, achieve root + load the official KernelSU 3.3.1 , and package it as an Android App. !WARNING This project...

iqoo-temp-root

vivo/iQOO Temporary Root Toolkit No bootloader unlocking, no flashing needed, temporary root lost on reboot. Core principle: CVE-2026-43499 futex PI UAF kernel exploit + temporary KernelSU loading. Supported devices App version Device| Codename| Payload ---|---|--- iQOO Z10 Turbo| z10t / iqooz10t...

K50G-POCOF4GT-CVE-2026-43499-PoC

Redmi K50 Gaming ingres — CVE-2026-43499 GhostLock Temporary Root PoC One-click temporary Root without unlocking BL. Uses the GhostLock CVE-2026-43499, futex PI Use-After-Free local privilege escalation chain to obtain a root anchor, then mounts the kernelsu module into the running kernel via...

ghostlock-k419-adapter

GhostLock — OnePlus Locked Bootloader Jailbreak Kernel exploit for OnePlus/OPPO/realme devices with locked bootloader. Achieves root + KernelSU installation without unlocking bootloader or modifying boot image. Runtime auto-detection of kernel version with multi-device offset table. Vulnerability...

Vulnerability_PoC

The PoC/Exploit of some interesting vulnerabilities Author: Vulnerability Research Team of Numen Cyber Labs 1. TCP/IP RCE Vulnerability CVE-2022–34718 PoC Restoration and Analysis...

CVE-2026-98260-PMX110-Root618-Jailbreak

Root618 · CVE-2026-98260 PMX110 / PYB110 Root618 is a one-click LKM Loadable Kernel Module jailbreak tool for the OPPO Find X10 Pro Max PMX110 and OnePlus 16 PYB110. The Android side is native Java no Gradle: direct compilation with aapt2 + javac + R8, while the kernel side achieves privilege...

pixel-ksu-root

pixel-ksu-root Root a stock, locked-bootloader Google Pixel from an unprivileged adb shell, using a kernel CVE — no unlock, no flash, no vendor help. A userspace-reachable kernel bug yields a short-lived read/write primitive. That primitive is spent late-loading a KernelSU module into the running...

CVE-2026-109618-109619-audit

CVE-2026-109618 / CVE-2026-109619 Audit of the "php2shell" claims, plus one working local PoC. 中文 · PHP 8.5.4 · lab-only MITRE: CVERECORDDNE · NVD: no record · php.net: pre-announcement only. This repo audits the technical claims; it does not confirm the identifiers. 30-second verdict Question|...

CVE-2026-98260-vivo-s60-poc

CVE-2026-98260 vivo S60 PD2571 PoC POSIX CPU timer UAF → uid-0 shell + KernelSU late-load 仅用于对自己拥有或已获授权的设备进行安全研究。利用代码刻意不做持久化、不写分区、不留下后门；使用风险自负。 背景 因为更新了谷歌安全更新10月补丁，导致无法使用 ghostlock 临时root 目标设备 项目| 值 ---|--- 设备| vivo PD2571 / V2571A vivo S60 内核| 6.1.145-android14-11-maybe-dirty 系统版本| 16.0.11.15.W1...

oppo-ghostlock

English | 简体中文 findn2-ksu-chain KernelSU late-load on a locked OPPO Find N2 — full chain, self-built LKM, no unlocked bootloader. futex-PI write primitive → cred overwrite → ADRP overflow fixed → kernelsu.ko live ✨ What is this A complete, working research chain that loads a self-compiled KernelS...

GhostLock

GhostLock - CVE-2026-43499 Local Privilege Escalation Exploit Vulnerability Overview CVE ID: CVE-2026-43499 Vulnerability Type: futex PI priority inheritance stack UAF Use-After-Free Affected Range: Linux kernel 6.1 6.12 Android GKI Exploitation Impact: Local privilege escalation + SELinux disabl...

CVE-2026-98260

CVE-2026-98260 Timer LPE CVE-2026-98260 POSIX CPU timer UAF 移植，支持情况见「内核支持」 两条链： timer：真实 cred 零写 → uid=0、u:r:shell:s0（shell 域 root，bset caps） timer fake：fake cred（full caps）→ 安装版 KernelSU libksud.so late-load 状态 路径| 结果 ---|--- real cred 零写 + setuid0 + exec sh| uid=0、u:r:shell:s0、ROOTSHELLOK fake...

GhostLock-CVE-2026-98260

CVE-2026-98260 for iQOO Neo11 V2520A A local privilege escalation payload based on a POSIX CPU Timer UAF, adapted for kernel 6.6.89-android15-8. ⚠️ Notes This vulnerability is a kernel-mode memory corruption UAF; the first run will most likely cause the phone to go black or a kernel Panic crash an...