Exploit for Use After Free in Linux Linux_Kernel CVE-2026-43499

## https://sploitus.com/exploit?id=51D44121-FC17-5C41-9E9C-79C85937ED56
# Aristotle ADB Enable

A minimal Android app that turns on **ADB** on an **au/KDDI Xiaomi "aristotle"
(XIG04, Android 12)** whose developer options can't be reached, using a
temporary root obtained from **CVE-2026-43499**. It is a device-owner tool in
the same category as KingRoot: it roots your own phone to flip a setting.

> Scope: your own XIG04 running
> `Xiaomi/XIG04_jp_kdi/XIG04:12/SP1A.210812.016/V14.0.3.0.TMFJPKD`.
> Not a general-purpose or remote exploit.

---

## What it does

One button, one job:

1. Stage the exploit payload (`preload.so`) out of the APK into the app's
   private `filesDir`, `chmod 0700`.
2. Fire the kernel bug by launching a short-lived `/system/bin/true` with
   `LD_PRELOAD` pointing at that payload. The payload's ELF constructor triggers
   the Futex-PI use-after-free, takes tmp-root, and self-installs an `su`
   client + daemon.
3. Confirm root by running `su -c id` and checking for `uid=0`.
4. Enable ADB as root:
   - `settings put global development_settings_enabled 1`
   - `settings put global adb_enabled 1`
   - `stop adbd; start adbd` (falls back to `setprop ctl.restart adbd`)

Every step is echoed to an on-screen log.

## The vulnerability

**CVE-2026-43499** — a use-after-free in the Linux kernel Futex-PI path
(`kernel/locking/rtmutex.c`, `remove_waiter()`). aristotle's
`5.10.136-android12` kernel is affected (`CONFIG_FUTEX_PI=y`,
`CONFIG_RT_MUTEXES=y`). The exploit uses a data-only "direct-root" (swap `cred`,
flip SELinux enforcing) and brute-forces MTE tags to survive the device's
hardening. The exploit source and the measured aristotle offsets live in the
**`exploit/` git submodule** of this repository.

---

## The payload is built automatically

`preload.so` is **not committed**. It is produced from the `exploit/` submodule
and embedded into the APK at build time:

- `exploit/` — git submodule: the CVE-2026-43499 aristotle exploit (builds
  `preload.so`).
- Gradle task `buildExploitSo` (wired into `preBuild`) runs the exploit's
  `make ... API=31`, then copies the resulting `preload.so` into
  `app/src/main/assets/exploit/preload.so` before the APK is packaged.

A normal `./gradlew assembleDebug` therefore builds the payload and ships it,
provided the Android NDK is installed.

## Building

```sh
# 1. fetch the exploit submodule
git submodule update --init --recursive

# 2. install the Android NDK r29 (the exploit Makefile auto-detects it,
#    or export ANDROID_NDK_ROOT), plus JDK 17 and Android SDK platform 34

# 3. build — auto-builds preload.so (API=31) and embeds it
./gradlew assembleDebug          # -> app/build/outputs/apk/debug/app-debug.apk
```

No NDK / just want the app shell? Skip the payload build (the app then reports
"exploit payload NOT deployed" and changes nothing at runtime):

```sh
./gradlew assembleDebug -PskipExploitBuild
```

**Wrapper jar:** `gradle-wrapper.jar` is not committed. Generate it once with
`gradle wrapper --gradle-version 8.2`, or build with a system Gradle (CI uses a
system Gradle, so no wrapper jar is required there).

## CI / releases

`.github/workflows/build-release.yml` (GitHub Actions) builds the APK on **every
push** and publishes it as a **GitHub Release** (tag `build-`), with the
`app-debug.apk` attached. The workflow checks out the `exploit` submodule,
installs JDK 17 / Android SDK 34 / NDK r29, and runs `gradle assembleDebug`,
which builds and embeds `preload.so` (API=31).

One-time setup: push this repo and the exploit repo to the **same GitHub owner**
as sibling repositories, so the submodule's relative url resolves. If the
exploit repo is private, add a `repo`-scoped PAT as the secret `SUBMODULE_PAT`
and uncomment the `token:` line in the workflow.

## Layout

```
.
├── settings.gradle / build.gradle / gradle.properties   Gradle wiring
├── gradlew(.bat) + gradle/wrapper/                       wrapper
├── exploit/                                              git submodule (builds preload.so)
└── app/
    ├── build.gradle          minSdk 31 / targetSdk 31 / compileSdk 34, arm64-v8a; buildExploitSo task
    └── src/main/
        ├── AndroidManifest.xml         single launcher Activity, no dangerous perms
        ├── java/.../MainActivity.kt    button + scrolling log
        ├── java/.../ExploitRunner.kt   stage → LD_PRELOAD → su -c "settings ..."
        ├── res/{layout,values}/        UI, strings, theme
        └── assets/exploit/             preload.so is embedded here at build time
```

## Running

1. `git submodule update --init --recursive`, install the NDK, then
   `./gradlew assembleDebug`.
2. Install and launch on the XIG04. If ADB is what you're trying to enable,
   install the APK from the device itself (file manager / browser download) and
   open it from the launcher.
3. Tap **Enable ADB (tmp-root)** and watch the log. On success it ends with
   `adb_enabled is now: 1`.
4. Connect ADB from your PC as usual.

## Limitations / caveats

- **Single build.** Offsets are pinned to the ROM above; a different build needs
  a re-ported payload.
- **tmp-root is volatile.** Root is lost on reboot. `adb_enabled` in global
  settings usually persists, and adbd does not need root once enabled.
- **SELinux / W^X.** Executing an app-private file via `LD_PRELOAD` can be denied
  depending on the app domain; the exploit's own strategy handles this, and any
  denial is surfaced in the log rather than hidden.
- **Device-owner use only.** This is for unlocking ADB on hardware you own.