- android
- linux
- kernel
- lpe
- cve
- futex
- selinux
- gki
news
Android Futex PI UAF Root Chains (CVE-2026-43499)
Futex PI use-after-free (kernel 2.6.39–pre-7.1) powers GhostLock/unplus-style locked-bootloader root on GKI 6.12; dual PoCs topped Sploitus weekly list.
Summary
CVE-2026-43499 is a long-lived Linux kernel futex Priority Inheritance (PI) use-after-free (reported scope roughly kernel 2.6.39 through before mainline 7.1). In late July 2026, Sploitus featured two related Android weaponization trees — GhostLock (OnePlus 15T / SM8850 adaptation) and unplus (device-parameter template + core write primitives) — that use the bug for locked-bootloader local root, SELinux disablement, and optional KernelSU staging.
Mainline fix referenced in public READMEs: commit 3bfdc63936dd (kernel 7.1). Android GKI 6.12.x was still called out as vulnerable at indexing time. CVSS on Sploitus cards: 7.8.
OFFSITE.DARK indexes Sploitus listings and high-level impact only; we do not redistribute device-tuned exploit parameters.
Technical Details
| Aspect | Detail |
|---|---|
| CVE | CVE-2026-43499 |
| Class | Futex PI use-after-Free |
| Mechanism (public) | pselect6 / fd_set stack interaction with PI waiters → reallocated rt_mutex_waiter → rb-tree rebalance arbitrary write |
| Typical chain goals | selinux_state.enforcing = 0; overwrite creds toward init_cred |
| Android note | Requires per-device offsets (KASLR slide, SELinux golden bytes, percpu bases) |
Two Sploitus entries for the same CVE:
| Listing | Focus |
|---|---|
| GhostLock / OnePlus 15T | Verified on ColorOS 16 / kernel 6.12.38-android16-… |
| unplus core logic | Template target.h for OEM adaptation |
Impact
Local app/ADB context → root on vulnerable Android GKI builds without unlocking the bootloader. Enables persistence frameworks (KernelSU) and full device compromise. Enterprise MDM / BYOD fleets on unpatched GKI 6.12 are the primary concern.
Mitigation
- Apply OEM security patches that include the futex PI UAF fix; track Android Security Bulletin / OEM monthly trains.
- Prefer devices that have moved to patched GKI or vendor kernels incorporating the mainline 7.1 fix.
- Restrict sideloading / untrusted app install; treat physical access + unlocked debugging as high risk.
- EDR/MDM: alert on unexpected
su/ KernelSU artifacts and SELinux permissive transitions from user apps. - Monitor Sploitus/GitHub for new OEM ports of the same primitive.