In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]
PoC: IonStack-S22U
CVE-2026-43499 full exploit chain for Samsung Galaxy S22 Ultra (Android 5.10 kernel)
[POC] CVE-2026-43499 — CVE-2026-43499-popsicle
CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k
[POC] CVE-2026-43499 — CVE-2026-43499-Neo11Plus
the CVE-2026-43499 by iqooneo11
PoC: ghostlock-s26
GhostLock (CVE-2026-43499) for the Galaxy S26
PoC: pixel-ksu-root
adb-driven KernelSU loader for stock Google Pixel: temporary kernel R/W via CVE-2026-43499 (GhostLock), then late-loads a signature-matched kernelsu.ko for the running KMI. Manager-agnostic.
[POC] CVE-2026-43499 — GhostLock-Galaxy
Root your Galaxy using CVE-2026-43499
PoC: iQOO-Z9_5G-vivo-T3_5G-Root-GhostLock
An iQOO Z9 5G and vivo T3 5G jailbreak/root CVE-2026-43499 Android application and payloads. Both devices use the MediaTek Dimensity 7200 (MT6886) platform. Kernel version 5.15.178.
[POC] CVE-2026-43499 — Mi8E5-Unlocker-by-CVE-2026-43499
基于 CVE-2026-43499 的 8E5 机型自动化解锁辅助工具，仅限授权安全研究与自有设备使用。
[POC] CVE-2026-43499 — tcp-zerocopy-sm
ghostlock + tcp-zerocopy hybrid CVE-2026-43499 port
[POC] CVE-2026-43499 — ghostlock-oneplus
GhostLock (CVE-2026-43499) kernel exploit for OnePlus devices with locked bootloader
[POC] CVE-2026-43499 — root-my-s9280
Using CVE-2026-43499 to root your Galaxy S24 Ultra(SM-S9280 ,(China / Hong Kong SAR / Taiwan))
[POC] GHSA-8qqm-fp2q-v734 — CVE-2026-43499-S25U
Galaxy S25 Ultra SM-S938N S938NKSUACZF1 port of CVE-2026-43499
[POC] CVE-2026-43499 — GhostLock-5.10
Kernel root exploit (CVE-2026-43499) for some 5.X devices (mostly Amazon)
[POC] CVE-2026-43499 — iqoo-temp-root
vivo/iQOO 临时 root 工具箱 (免解锁临时root, CVE-2026-43499) - 源码与脚本
PoC: debian-on-s23-ultra
A Samsung Galaxy S23 Ultra running Debian 13 as a server. The bootloader is locked, so an app re-establishes root after every reboot: Shizuku, CVE-2026-43499, KernelSU Next late-load, then a Debian chroot with sshd. One APK, quickstart, chroot bootstrap, and notes on everything that did not work.
PoC: RootMyVivo-Exploit
Hardened CVE-2026-43499 (GhostLock futex PI UAF) injection payload source tree for vivo and iQOO devices
PoC: redmi-note-12t-pro-kernel
Unofficial kernel patches, security fixes, and tools for the Redmi Note 12T Pro (pearl); currently includes the CVE-2026-43499 fix. Kernel-only releases with checksums, build/verify guides, and a sanitized reboot case study.
PoC: ghostlock-pfem10
GhostLock (CVE-2026-43499) for OPPO Find X5 Pro (PFEM10) — OPlus watchdog & heap-spray detector reverse engineering
PoC: ghost-hoock
GhostLock stripped to one primitive: SELinux off on Galaxy A17 (BZA5) via futex PI UAF (CVE-2026-43499). No root, no cred patch, no rwforge.
PoC: ghostlock-sabrina
CVE-2026-43499 GhostLock root exploit for Chromecast with Google TV (sabrina)
PoC: ghostlock-s26
GhostLock (CVE-2026-43499) app for the Galaxy S26 series
PoC: ghostlock-aak-apk
GhostLock AAK Launcher - CVE-2026-43499 Linux kernel rtmutex stack UAF local privilege escalation trigger (GPLv3)
PoC: cve-2026-43499-honor
CVE-2026-43499 (GhostLock) rt_mutex stack-UAF privilege escalation research on Honor BVL-AN16 (Magic6 Pro, SM8650, kernel 6.1.128). Includes analysis docs, reverse-engineering scripts, disassembly artifacts, and exploit source with honor-BVL-AN16 target adaptation.
PoC: KSuRoot
KSuRoot 2.2.0 — One-click KernelSU rooting based on CVE-2026-43499. Synced from Root-My-Galaxy v0.2.6 with custom payload (.so) import. Mod by hmascs
PoC: ghostlock-cve-2026-43499-4.19-k40
CVE-2026-43499 (GhostLock) rtmutex remove_waiter() UAF local-root PoC adapted for Qualcomm Android 4.19 kernels (Redmi K40 / Snapdragon 870 class), LD_PRELOAD based
PoC: ghostlock-apk
独立 APK：CVE-2026-43499 GhostLock 提权 + Shizuku shell 身份执行
PoC: ghostlock-honor-aak-probe
该仓库已经确认此漏洞利用不可能实现、已判死刑，永久性停止更新。基于 CVE-2026-43499 (rtmutex remove_waiter UAF) 的 GhostLock exploit 半成品工程，KASLR 绕过 / 提权 / su 植入等环节均无法稳定利用，本项目永久终止。
PoC: GhostLock-Next
The next implementation of GhostLock CVE-2026-43499
PoC: honor90-ghostlock
GhostLock (CVE-2026-43499) + KernelSU late-load port for Honor 90 REA-NX9, MagicOS 9.0.0.211 / Android 15 (pure-GKI 5.10.236). Fork of GhostLock-H80GT.
PoC: REDMI_Root
Redmi Pad Pro (dizi) 内核 Root 方案 — CVE-2026-43499 select_stack 适配，KernelSU 越狱模式
PoC: Root-My-Galaxy-Payloads-SM-S928N
Device-specific CVE-2026-43499 payload profile for Galaxy S24 Ultra SM-S928N (S928NKSU6EZIF, Android 17, kernel 6.1.162)
PoC: redmi-13-5g-ghostlock-findings
Static (offline) feasibility notes for GhostLock / CVE-2026-43499 on Redmi 13 5G, kernel 5.10.236-android12-9. NOT TESTED ON A DEVICE. Partially derived offsets + stack-geometry analysis.
PoC: ghostlock-rmx5085
Porting CVE-2026-43499 (GhostLock) to the Realme GT 7T (RMX5085): device profile from the phone's own boot.img, KernelSU late-load, one-tap root via Anchor, and the four calibrations that made it work
PoC: ghostlock-honor-brpnx1
GhostLock (CVE-2026-43499) port for HONOR Magic 7 Lite / X9C 5G (BRP-NX1) — kernel 5.10.252, SM6450 Snapdragon 6 Gen 1. Includes 7 patches for 5.10 compact waiter support.
PoC: ALI-AN00-cve-2026-43499
Honor X50 (ALI-AN00/ALI-TN00) local privilege escalation for CVE-2026-43499 (GhostLock, kernel rtmutex remove_waiter UAF). Target offsets measured from the device's own boot images.
PoC: Ghostlock-Honor70Pro
Honor 70 Pro privilege escalation PoC: GhostLock (CVE-2026-43499) but could not custom KernelSU module loading
PoC: ghostlock-app
Android kernel privilege escalation via the futex-PI waiter UAF (CVE-2026-43499), with vivo/iQOO vr.ko neutralization
PoC: rmg-s9110-research
Root My Galaxy (CVE-2026-43499) exploit-grooming research log for Samsung Galaxy S23 SM-S9110 (dm1q / android13-5.15). Reverse-engineering notes, experiment journals, and step-by-step beginner-friendly docs.
PoC: RootMyVivo-Exploit
Hardened CVE-2026-43499 (GhostLock futex PI UAF) injection payload source tree for vivo and iQOO devices
PoC: IQOO-neo7-ghostlock-43499
基于CVE-2026-43499（ghostlock）的 iQOO Neo7 提权移植，希望能为5.10系内核的机型提供一些参考。
PoC: Root-My-Galaxy-Payloads-KernelSU
Firmware-specific CVE-2026-43499 and KernelSU payload for Samsung Galaxy S25 Ultra SM-S938N (KOO), S938NKSUCDZIF, Android 17 / kernel 6.6.127.
PoC: Root-My-Galaxy-Payloads-S938NKSUCDZIF
Firmware-specific CVE-2026-43499 and KernelSU-Next payload for Samsung Galaxy S25 Ultra SM-S938N (KOO), S938NKSUCDZIF, Android 17 / kernel 6.6.127.
PoC: CVE-2026-43499
GhostLock futex-PI UAF LPE exploit for POCO M7 5G - kernel 5.10.226
PoC: RootMyVivo-rs
Cross-platform pure-Rust toolchain for unlock-free temporary root and KernelSU late-loading on vivo/iQOO devices (CVE-2026-43499)
PoC: zenfone9-ghostlock
CVE-2026-43499 (GhostLock) exploit for ASUS Zenfone 9 (SM8475, GKI 5.10.205) + KernelSU late-load.
PoC: Root-My-Device
KSU installer for supported firmware with CVE-2026-43499
PoC: CVE-2026-43499
a-16 kernel in
PoC: ghostlock-mrx-w09
CVE-2026-43499 (GhostLock) port: working root on the Huawei MatePad Pro MRX-W09 (Kirin 990, EMUI 11, Linux 4.14.116) - disassembly-proven write primitive, perf cred leak, and a source-derived HKIP bypass
PoC: honor-6.12.38-43499-research
CVE-2026-43499 Honor YLP-W00 (6.12.38 PGO) root research
PoC: ghostlock-app
GhostLock One-Tap Execution App (CVE-2026-43499)
PoC: Lenovo-TB365FC-GhostLock-CVE-2026-43499
GhostLock (CVE-2026-43499) root + KernelSU LKM for the Lenovo TB365FC (ZUXOS / Android 16, kernel 5.15.170)
PoC: neo8-ghostlock-adaptation
iQOO Neo8 (PD2301, 5.10.246 GKI) CVE-2026-43499 GhostLock 适配 · 48 宏 target.h + offsets.json + 15 轮实测 log · 只缺 write layer
PoC: s9180-rootmygalaxy
RootMyGalaxy for Galaxy S23 Ultra SM-S9180 (FZG1) - temp root via CVE-2026-43499, KernelSU late-load, no partition flashing, no Knox
PoC: humane-aipin-ghostlock
Guarded, source-only Humane AI Pin root PoC for CVE-2026-43499
PoC: Fold8-Ultra-Root-F976N
One-tap KernelSU installer for the Galaxy Z Fold 8 Ultra (SM-F976N / q8q) using the CVE-2026-43499 late-load exploit via Shizuku. Supports F976NKSU1AZGI, F976NKSS2AZH7, F976NKSU3AZI5
PoC: ghostlock-pfem10
GhostLock (CVE-2026-43499) for OPPO Find X5 Pro (PFEM10) — OPlus watchdog & heap-spray detector reverse engineering
PoC: asus-i005-cve-2026-43499
CVE-2026-43499 (GhostLock) adaptation for ASUS ROG Phone 5S — UAF trigger + pselect stack reclaim, KASLR leak blocked
PoC: IonStack_S21
Exploit chain research targeting CVE-2026-43499 on Samsung Galaxy S21
PoC: aquos-r6-ghostlock
Temporary root exploit for Sharp AQUOS R6 A101SH S0029 using GhostLock CVE-2026-43499
PoC: meizu21-ghostlock-root
MEIZU 21 locked-bootloader runtime root via CVE-2026-43499 and KernelSU late-load
PoC: Root-My-Galaxy-Payloads
CVE-2026-43499 root payloads feed for Root-My-Galaxy
PoC: ghost-hoock
GhostLock stripped to one primitive: SELinux off on Galaxy A17 (BZA5) via futex PI UAF (CVE-2026-43499). No root, no cred patch, no rwforge.
PoC: cve-2026-43499-firetv-sheldonp-writeup
Security research write-up on exploiting CVE-2026-43499 on the Amazon Fire TV Stick 3rd Gen (sheldonp), from temporary root to bootloader unlock.
PoC: ghostlock-cve-2026-43499-4.19-k40
GhostLock CVE-2026-43499 Redmi K40 (alioth 4.19.157) adaptation
PoC: ghostlock-kit
GhostLock kit for vivo iQOO Neo9S Pro (MT6989): MCAST transport port, one-click root scripts and writeups (CVE-2026-43499)
PoC: cve-2026-43499-aak-an00
Honor WIN RT (AAK-AN00) CVE-2026-43499 temporary root - research notes
PoC: ghostlock-pfem10
GhostLock (CVE-2026-43499 / IonStack) research for OPPO Find X5 Pro (PFEM10): exploit chain, progress, blocker log, and OPPO 5-series kernel notes
PoC: RootMyVivo-Exploit
GhostLock (CVE-2026-43499) exploit fork for RootMyVivo Neo — iQOO Neo 11 (PD2520, SM8750, 6.6.89). For authorized research on own devices only.
PoC: GhostLock-NVIDIA-Shield-9.2.4
Validated GhostLock CVE-2026-43499 port for NVIDIA Shield TV Pro mdarcy 9.2.4
PoC: galaxy-a37-root
CVE-2026-43499 exploit payload for Samsung Galaxy A37 (A376BXXS4AZG4, kernel 6.1.138-android14-11)
PoC: galaxy-a37-root
CVE-2026-43499 exploit payload for Samsung Galaxy A37 (A376BXXS4AZG4, kernel 6.1.138-android14-11)
PoC: ghostlock-s25fe
GhostLock (CVE-2026-43499) for the Galaxy S25 FE (W.I.P)
PoC: root-s24-e1s
Galaxy S24 SM-S921B S921BXXSDCZB2 RAM-only KernelSU Next (CVE-2026-43499) + Root S24 app
PoC: ghostlock-x200-app
vivo X200 设备端一键 root App（Shizuku 授权 shell 域执行，CVE-2026-43499）
PoC: Root-My-Galaxy
KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499
PoC: ghostlock-oppo-watch3pro
CVE-2026-43499 on OPPO Watch 3 Pro
PoC: rmgp-complete-handoff
Complete RMGP (CVE-2026-43499) workspace + experiment-state handoff for SM-A376B/A376BXXU1AZB7
PoC: ghostlock-pfem10
GhostLock (CVE-2026-43499 / IonStack) research for OPPO Find X5 Pro (PFEM10): exploit chain, progress, blocker log, and OPPO 5-series kernel notes
PoC: rmg-s9180-fzg1
Root My Galaxy SM-S9180 (dm3q) S9180ZHS8FZG1 payload port - CVE-2026-43499 + KernelSU LKM
PoC: ghostlock-infinix-hot70
Proof-of-concept kernel exploit for GhostLock (CVE-2026-43499) on the Infinix Hot 70.
PoC: vivo-root-build
vivo/iQOO 提权 so 编译（CVE-2026-43499）
PoC: RootMyVivo
One-click root for vivo/iQOO devices on locked bootloader | CVE-2026-43499 + KernelSU
PoC: ghostlock-k419-adapter
GhostLock (CVE-2026-43499) adapter for 4.19.152-perf+ Android kernel
PoC: CVE-2026-43499-NAM-AL00
Security research: CVE-2026-43499 GhostLock on Huawei Nova 9 NAM-AL00 (SM7325, HMOS 4.2, kernel 5.4.86-qgki)
PoC: ghostlock-h8q
GhostLock CVE-2026-43499 port for Galaxy Z Fold 8 (h8q)
PoC: CyberMeowfiaNS
The next stage of CyberMeowfil (CVE-2026-43499 and 43074),Possibly biased toward vivo devices?
PoC: GhostLock-H80GT
Honor 80 GT (MagicOS 8.0.0.128, kernel 5.10.168) privilege escalation PoC: GhostLock (CVE-2026-43499) + custom KernelSU module loading
PoC: GhostLock_MT6983V_5.10
High-risk vulnerability CVE-2026-43499, implementation on the 5.10 kernel and MediaTek MT6983V
PoC: s26-m1q-ghostlock-selinux
GhostLock CVE-2026-43499 research for Galaxy S26 (SM-S942U1/m1q): SELinux Permissive achieved, KASLR + tracefs port, uid=0 boundary documented
PoC: ghostlock-custom
GhostLock (CVE-2026-43499) adaptation for non-Android Linux 6.x ARM64
PoC: CVE-2026-43499_HW-CLT-AL01
尝试移植CVE-2026-43499提权漏洞到HW P20Pro上
PoC: ghostlock-cve-2026-43499
CVE-2026-43499 (GhostLock) — Linux kernel futex PI rt_mutex UAF ARM32 privilege escalation research targeting Huawei Watch 4 Pro (kernel 5.4.210)
PoC: ghostlock-a17
CVE-2026-43499 port for Samsung Galaxy A17
PoC: IonStack-S22-cve-2026-43499
Full root in kernel domain with selinux permissive
PoC: CVE-2026-43499-ZFOLD4
CVE-2026-43499 research port for Galaxy Z Fold4 SM-F936W F936WVLU1AVGA (in progress)
PoC: cve-2026-43499-m3q-azf1
This package is not a complete root. It flips SELinux to Permissive and holds reclaim long enough for follow-on work. Host `uid=0` is not achieved here.
PoC: GhostLock
CVE-2026-43499 futex PI stack UAF ???????? - Android GKI 6.1~6.12 ??????? pselect() + futex PI ????????????,??? root ??? SELinux??? OPPO Find X8?OnePlus ??????
PoC: F9360-CVE43499
SM-F9360 (Galaxy Z Fold4, q4q) locked-bootloader KernelSU root — CVE-2026-43499 temp root → LD_PRELOAD DEFEX bypass → no-LTO clang-12 kernelsu.ko. Device-verified 2026-08-12.
PoC: GhostLock-OPPO-PCKM00
CVE-2026-43499 GhostLock futex UAF LPE PoC for OPPO PCKM00 (SM6150) / Linux 4.14.180
PoC: ghostlock-skeleton-v2
CVE-2026-43499 GhostLock APK 骨架 — 从零开始，仅空项目编译验证
PoC: ghostlock-skeleton
CVE-2026-43499 GhostLock APK 骨架 — 仅验证空项目能编译通过
PoC: ghostlock-x200-root
GhostLock-X200 v1.0 - temporary root toolchain for vivo X200 (PD2415 / b57 kernel) based on CVE-2026-43499. For authorized security research only.
PoC: GhostLock-GOT-W29
CVE-2026-43499 (GhostLock) research on HUAWEI MatePad Pro 11 GOT-W29
PoC: Root-My-Galaxy-tests
KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499 (Note: Fork)
PoC: Root-My-Galaxy
KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499
PoC: CVE-2026-43499-T807D
T807D CVE-2026-43499 research project
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free