Exploit for Use After Free in Linux Linux Kernel

## https://sploitus.com/exploit?id=CF991020-D4D1-545A-BB38-599DBE466897
# GhostLock APK

**Standalone APK:** CVE-2026-43499 – GhostLock kernel privilege escalation + Shizuku shell execution.  
## Prerequisites

- Honorio AAK-AN00 / MagicOS 10 / Linux 6.6.89 / 4KB page size  
- Shizuku must be installed and started via adb (`adb shell sh /sdcard/Android/data/moe.shizuku.privileged.api/start.sh`)  
- USB debugging must be enabled  

## How it works

1. **Shizuku UserService**: After the APK is launched, it requests the UserService from Shizuku. When Shizuku is started via adb, the UserService runs with a **shell UID of 2000** and has write permissions for `/data/local/tmp/`.  
2. **Release the exploit binary**: The built-in `ghostlock` (CVE-2026-43499 GhostLock privilege escalation ELF) is written to `/data/local/tmp/a/ghostlock` through Shizuku.  
3. **Execute privilege escalation**: Execute `ghostlock` as a shell; trigger the kernel vulnerability → gain root access → perform the final execution.  

## Building

```bash
# 1. Download Shizuku API
curl -L -o app/libs/shizuku-api.aar \
  https://github.com/RikkaApps/Shizuku-API/releases/download/v13.5.4/shizuku-api-13.5.4.aar

# 2. Place the GhostLock binary
# cp /path/to/ghostlock app/src/main/assets/ghostlock

# 3. Build
./gradlew assembleRelease
```

## CI

GitHub Actions automatically builds: Push to the main branch or manually trigger the `workflow_dispatch`.  

## Disclaimer

This tool is for security research purposes only. All risks are assumed by the user.