DirtyFrag README

The project's README from github.com/mitschud/DirtyFrag. As one markdown file: README.md.

DirtyFrag (CVE-2026-43284)

DirtyFrag is a hardened fork of diabl0w/DFRoot. It exploits CVE-2026-43284 (DirtyFrag), a kernel page cache write primitive, to load a kernel module without an unlocked bootloader and without a custom kernel. The fork targets Samsung phones (OneUI, RKP and KDP hardening) and keeps upstream's SU-manager agnostic design.

[!IMPORTANT] Root is ephemeral. The kernel module, su and any loaded modules are gone the moment the device reboots. A reboot always returns the phone to a clean, unrooted state - which is also the recovery path if a run goes wrong.

Install

  1. Install the DirtyFrag APK from Releases.
  2. Install an SU manager that ships libksud.so:
  3. Open DirtyFrag, pick your manager in the SU Manager card, then press Run exploit.

[!WARNING] Since 1.10 (upstream 3.2) DirtyFrag no longer bundles ksud - it is staged from the selected manager's own libksud.so. A manager that does not ship that library cannot give you root. The older advice to install a CI / Actions build of the manager no longer applies.

A fresh install of DirtyFrag gets a new Android UID, so the grant in the manager has to be given again after every reinstall.

Screenshot_20261015_220718

Features

FAQ

Q: Log says patching failed and that my device isn't vulnerable

A: Sorry, there is no fix. Either:

Q: Log says "SUCCESS" or "ksud exited with error", but I don't have root

A: Turn off Auto reboot on the Autorun card if it is enabled - a soft reboot that the manager cannot complete leaves the loaded module unloaded again. Otherwise see upstream discussion 69.

Q: I installed a module and now I can't launch root without crashing

A: Set the KernelSU Modules card to Disabled and reroot. The switch works without root, which is the point - it is the escape hatch when a module is the thing that is crashing the run.

Q: Module + Autorun and now I am bootlooping

A: Android usually detects the bootloop and offers Safe Mode; otherwise hold Volume Down during boot. From Safe Mode turn Autorun off and set KernelSU Modules to Disabled, or just uninstall DirtyFrag until you stabilise. If you cannot get far enough into the system, adb uninstall df.root from any PC works on user builds without root.

Q: The progress bar sits at 0 percent

A: That is the app's log-marker mapping, not the exploit. The run window is 70 seconds - do not re-run a "slow" run, the daemon may still be working.

Q: How do I remove root cleanly?

A: Before unrooting, use file manager with root and delete /data/adb/KernelSU, KSUD residue (NOT ADB FOLDER ITSELF)

Building

JAVA_HOME="<Android Studio jbr>" ./gradlew assembleRelease

The APK is written to app/build/outputs/apk/release/dirtyfrag.apk.

Release builds are signed with app/keystore.jks, which is gitignored (the signing config expects alias dirtyfrag and dirtyfrag for both passwords). Generate your own before building:

keytool -genkeypair -v -keystore app/keystore.jks -alias dirtyfrag \
  -keyalg RSA -keysize 2048 -validity 10000 \
  -storepass dirtyfrag -keypass dirtyfrag

The eight prebuilt kernel modules are committed under app/src/main/jni/ko/. Upstream gitignores them and builds them per-KMI in CI; this fork commits them so a plain clone builds without a DDK toolchain. They are built by this repo's Build workflow (the LKMs / <kmi> jobs) from the current lkm/dfroot.c, so they must be rebuilt whenever that file changes: run the workflow, download the df-lkm-<kmi> artifacts and drop them in this directory. To build them yourself instead, use upstream's make / podman DDK flow.

How it works

The Android kernel decrypts AES-CBC ESP packets directly into the page cache of files open for splice(). By crafting IV = AES_ECB_DEC(key, current_content) XOR desired_content, any 16-byte-aligned block in a mapped shared library can be overwritten without write permission and without copy-on-write.

The exploit uses this primitive to patch shellcode into libc++.so in the kernel's page cache. The next privileged call to the hooked function runs the shellcode, which loads the kernel module via insmod.

Exploit chain

  1. IpSec transform - the app allocates a UdpEncapsulationSocket plus an SPI and builds an AES-CBC/HMAC-SHA256 ESP transform through IpSecManager.
  2. splicehelper -> crash_dump64 - splicehelper is spliced into crash_dump64 using the CBC primitive. crash_dump64 runs in the crash_dump SELinux domain, which can open vendor_file labelled files that untrusted_app cannot read - the bridge we need.
  3. dfroot.ko -> vendor_file - the kernel module is written through that bridge into a vendor_file-labelled file.
  4. libc++ hook (fires in init, uid=0, tid=1) - shellcode patched at std::ostream::sentry::sentry(). It checks uid and tid, creates /dev/df as a one-shot mutex so it cannot re-enter, then execs insmod in the vendor_modprobe domain.
  5. dfroot.ko init - sets SELinux permissive, bypasses DEFEX via kprobes where present, then uses call_usermodehelper to run the bootstrap.
  6. bootstrap - reads the app's device-protected settings, adopts the zygote environment, sets partitions read-only, optionally disables all modules, and finally launches the SU daemon from your installed SU manager.

Credits

DirtyFrag (mitschud/DirtyFrag)

penetration-testing
Searching Database…

500 ·GitHub
DirtyFrag
What is this?DirtyFrag is a hardened fork of diabl0w's DFRoot that exploits CVE-2026-43284, a kernel page-cache write primitive, to temporarily root Samsung and other Android phones without an unlocked bootloader or a custom kernel.
How do I get root running with this?Install the DirtyFrag APK from Releases, install an SU manager that ships its own libksud.so, then open the app, pick that manager in the SU Manager card and press Run exploit.
Does any SU manager work with it?Only managers that ship their own libksud.so library; Samsung devices specifically require diabl0w's KernelSU fork, while other phones can use KernelSU, KernelSU-Next, KowSU or BakaSU.
Does the root survive a reboot?No, root is ephemeral: the kernel module, su and any loaded modules disappear the moment the device reboots, and rebooting is also the recovery path if a run goes wrong.
Which phones does this target?It is built for Samsung phones with OneUI, RKP and KDP kernel hardening, and only works on devices whose kernel hasn't been patched against or mitigated the underlying bug.
What if the device is not vulnerable?The app will log that patching failed and there is no fix in that case — it means the kernel is too new, the manufacturer backported the mitigation, or an accidental mitigation was hit, commonly on kernel 6.1.
I got a SUCCESS log but still have no root, what's wrong?Turn off Auto reboot on the Autorun card - a soft reboot the SU manager cannot complete leaves the loaded kernel module unloaded again.
What does the Odin pill in the toolbar show?It is a status indicator reporting whether the current firmware will still let the device enter Download mode, with a tap revealing the three facts behind that decision.
How do I remove root cleanly afterward?Before unrooting, use a root file manager to delete /data/adb/KernelSU and the KSUD residue files.
How does the underlying exploit actually work?It abuses the kernel decrypting AES-CBC ESP packets directly into the page cache, letting the app overwrite a 16-byte-aligned block of a mapped shared library without write permission, patching shellcode into libc++.so that then loads the kernel module via insmod.
What are similar projects?UniRoot, ghostlock-app, dirtyfrag, CVE-2026-41940-PoC, copy-fail-CVE-2026-31431, Claude-Red, Relapse-Exploit, V3SP3R
Which topics is it in?cve, privilege-escalation, root, security-research, vulnerability, exploit, hacking-tool, kernel, penetration-testing, hacking, android-app, app
Creator
mitschud
Size
9.9 MB
Stars
500
Updated
CommitOct 18Releasev1.16Oct 15
Age
18d
Commits · 90 Days