## https://sploitus.com/exploit?id=238DCD54-CB55-5351-8CA9-E392880CA594
# GhostLock CVE-2026-64560 — posix-cpu-timers UAF exploit for Vivo devices
`posix-cpu-timers` is a non-leader exec() competition that leads to a UAF privilege escalation exploit. **Vulnerability:** CVE-2026-64560 — Competition between `posix_cpu_timer_del()` and `de_thread()`, resulting in a UAF in `k_itimer`. **Impact:** Linux 5.7 ~ 6.1.179 (V2403A kernel 6.1.145 affected)
## Overview
```
Phase 1: UAF Trigger
`timer_create(CLOCK_PROCESS_CPUTIME_ID)` + non-leader thread exec() competition
→ `k_itimer` is released but remains locked in the cpu_timers rbtree → UAF
Phase 2: Heap Reclamation
`socketpair sendmsg` reclaims a freed slab → controls timerqueue_node
Phase 3: Pipe R/W
Manipulation of kernel physical memory via pipe buffer
Phase 4: KASLR Bypass
Boot_id oracle/kallsyms scanning
Phase 5: SELinux Disabling
Physical write to selinux_state.enforcing = 0
Phase 6: Root Privilege Escalation
Patch task cred → init_cred
```
## Build Process
```bash
# NDK Cross-Compilation
export ANDROID_NDK_HOME=/path/to/ndk
make
# Push to device
adb push exploit /data/local/tmp/
adb shell chmod 755 /data/local/tmp/exploit
adb shell /data/local/tmp/exploit --device V2403A
```
## Device Configurations
| Device | SoC | Kernel | Status |
|--------|-----|-------|--------|
| V2403A (iQOO Neo9S Pro+) | SM8550 | 6.1.145 | Testing |
| PD2403E (iQOO Neo9S Pro+ MA) | SM8550 | 6.1.124 | Testing |
## References
- [NebuSec/CyberMeowfia](https://github.com/NebuSec/CyberMeowfia) — Full exploit (line 5207)
- [villager1314/CVE-2026-64560-Analysis](https://github.com/villager1314/CVE-2026-64560-Analysis) — Vulnerability analysis
- [Kernel Fix Submission](https://git.kernel.org/tip/920f893f735e92ba3a1cd9256899a186b161928d)
## Disclaimer
This tool is used for security research purposes only. Please use it on devices for which you have permission or rights.