## https://sploitus.com/exploit?id=2B983483-C841-5A41-9682-7EE619D9429D
# CVE-2026-43499-pgp110
**CVE-2026-43499** (futex PI `rt_mutex_waiter` use-after-free, GhostLock) – Local privilege escalation, compatible with **OPPO Find X8 / PKB110** – MediaTek MT6991 (Dimensity 9400), ColorOS 16.
A file push is performed using `LD_PRELOAD`; after success, **KernelSU (ksud, late-load / jailbreak mode)** and the backup `su` daemon are installed simultaneously:
```sh
adb push out/preload-pkb110.so /data/local/tmp/preload.so
adb shell chmod 644 /data/local/tmp/preload.so
adb shell LD_PRELOAD=/data/local/tmp/preload.so /system/bin/true
```
After success:
```sh
adb shell /data/local/tmp/su -c id # UID=0(root); backup su daemon is running
adb shell /data/local/tmp/ksud... # KernelSU (late-load has been initiated)
```
**Actual testing (2026-07-28)**: Two consecutive runs without any environment variables changed resulted in “EXPLOIT OK”.
Write 1 and Write 2 were completed in 1–5 rounds, taking approximately 26–91 seconds each. Both “su” and “ksud late-load” worked properly. KernelSU’s management interface identified it as a jailbreak mode. | | |
| Device | OPPO Find X8 / PKB110 |
| SoC | MediaTek MT6991 (Dimensity 9400) |
| Kernel | `6.6.118-android15-8-gebdfad32d749-ab15099304-4k` (GKI, 4K pages) |
| Build | ColorOS 16 / `16.0.9.400(CN01)` |
| Bug | CVE-2026-43499. This bug was not fixed in this version (fixed in 6.6.140; this kernel version: 6.6.118) |
## What it does
By leveraging two write operations for the ghostlock 6.6 tree, it avoids relying on pipe-based physical reads/writes (the classic fops→configfs→pipe route fails systematically during pipe slab recycling on the host; this is due to the lack of a main pipeline for KernelSU):
- **Write 1** – SELinux is set to permissive (child PI writes)
- **Write 2** – The pointer from the forked child process “cred” is replaced with “init_cred” (perf task leakage + PI write)
- The root child process installs: the embedded “su” daemon (three locations), and the embedded “ksud” with “late-load --allow-shell”
Other key points:
- **Single file**: “su_daemon.c” is compiled into a standalone aarch64 PIE; its.incbin file is placed in “.rodata”. “Ksud” (4.5MB official build) also uses.incbin, and its output is written to `/data/local/tmp/ksud` during runtime.
- KASLR is not required: “data_addr()” uses a physical address linear mapping alias; KASLR only affects the image mapping.
- The calling process itself remains non-privileged – root is accessed through the daemon service, just like what you would do in the shell later.
- Root is not persistent; it needs to be rerun after restart.
## About SELinux (known trade-offs)
After Write 1, **SELinux is intentionally left at permissive** (original design of warhol-root/pmg110-root: the su daemon must serve non-privileged clients). KernelSU’s late-load mode doesn’t have kernel-level sepolicy patches. Therefore, **“setenforce 1” to restore enforcing will cause AVCs like “deny”**, while “setenforce 0” restores normal behavior. Restarting the phone can restore enforcing (but you’ll lose root access). Log locations:
- Process utilization: stdout / `/data/local/tmp/.ghostlock.log`
- ksud: `/data/local/tmp/ksud.preload.log`
- su daemon: `/data/local/tmp/su_daemon.log`
## Building
```sh
make # = make preload -> out/preload-pkb110.so
make DEVICE=pkb110 # Use targets/pkb110/
make devices # List available DEVICEs
make info # View selected targets and the associated toolchain
```
**Dependencies:** Linux host (x86_64 or aarch64), Android NDK (`ANDROID_NDK_HOME` must point to the correct location); [SnowNF/ndk-aarch64-linux](https://github.com/SnowNF/ndk-aarch64-linux)’s r29 available on aarch64 hosts; `make`. **How to generate target headers and offsets:**
```sh
python3 tools/extract_device.py boot.img --name pkb110 # Requires vmlinux-to-elf, capstone, lz4
```
## Directory Structure
```text. ├── Makefile
├── source/
│ ├── Makefile
│ ├── embed/ksud # The KernelSU userspace binary embedded in.incbin (tracked in git)
│ └── src/ # ghostlock 6.6 kernel exploitation code + ksud integration code
│ ├── main.c # Main process (Write 1 / Write 2 / root child processes)
│ ├── ksud_blob.S # Embedded in.incbin/ksud
│ ├── ksud_install.c # Code for writing ksud and late-load startup (ported from KernelSU’s preloader.c)
│ ├── su_daemon.c / su_blob.S / su_install.c # Warhol-root’s su implementation
│ └──... # More files…
│ ├── targets/
│ └── pkb110/ # Contains target.h and device_offsets.h for X8
├── tools/ # Includes extract_device.py, BTF, preloader memory layout, etc.
└── out/
```
## Credits
- [NebuSec/CyberMeowfia](https://github.com/NebuSec/CyberMeowfia) — Original implementation of GhostLock exploits (used by IonStack)
- [soralis0912/CVE-2026-43499-pmg110-root](https://github.com/soralis0912/CVE-2026-43499-pmg110-root) — Direct source for this repository (same SoC / same kernel family, tested on real machines)
- [x-spy/CVE-2026-43499-popsicle](https://github.com/x-spy/CVE-2026-43499-popsicle) — Source for warhol-root’s su installation path
- [JoinChang/ghostlock-oneplus](https://github.com/JoinChang/ghostlock-oneplus) — Source for ghostlock 6.6’s exploitation code
- [woshimaniubi8/CVE-2026-43499-root-KernelSU](https://github.com/woshimaniubi8/CVE-2026-43499-root-KernelSU) — Source for embedding ksud and integrating it with late-load
- Discussion posts related to GhostLock from @114515:
- [Kimi K3](https://www.kimi.com/) (AI assistant) — Reverse engineering, adaptation, and integration are carried out by Kimi K3
## Disclaimer
This project is intended for security research and learning purposes only. It can only be used on self-owned devices that have obtained explicit authorization. Using vulnerabilities without permission to attack others’ computer systems is illegal. Users must bear all consequences, and neither the author nor the upstream projects will assume any responsibility. If Root isn’t persistent, and SELinux remains permissive, the device’s security level will be reduced. Please restart the device after testing.