Ghostlock CVE-2026-43499 Root Shell on the Samsung Galaxy A1...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://mobilehackinglab.com/blog/cve-2026-43499-ghostlock-a17-root-shell
• Blog Title: Ghostlock: CVE-2026-43499 Root Shell on the Samsung Galaxy A17
• Suggested Section: Binary Exploitation > Linux kernel exploitation, with a cross-reference from Mobile Pentesting > Android Applications Pentesting; suggested page: Futex PI UAF, pipe_buffer physical R/W, and workqueue/usermode-helper privilege escalation (CVE-2026-43499 Ghostlock)

🎯 Content Summary

Overview

CVE-2026-43499, also called ghostlock, is a local Android/Linux kernel privilege-escalation vulnerability in the futex priority-inheritance use-after-free family. The exploit races object lifetime and page reuse to create forged pipe_buffer slots, then converts them into an arbitrary physical-memory read/write channel named rwforge.

This port targets the Samsung Galaxy A17 SM-A175F, with MediaTek mt6...

🔧 Technical Details

Futex PI UAF to arbitrary physical memory: Race a futex priority-inheritance object's lifetime and reclaim the affected allocation through pselect-related activity. A fake rt_mutex_waiter combined with rb-tree erase behavior can produce a constrained aligned-qword pointer write. Use this primitive to replace file operations with CFI-compatible handlers and then forge or overwrite pipe_buffer.page fields. Redirecting pipe slots to selected pages turns ordinary pipe operations into arbitrary physical-memory reads and writes.

KASLR disclosure through stable sysctl metadata: When noisy perf-based disclosures are unreliable or blocked by policy, use known kernel-resident ctl_table objects as slide anchors. Testing a triplet associated with boot_id provides a stronger slide oracle than accepting a single candidate, especially on arm64 systems with very large KASLR ranges.

Privilege escalation without writing ...

🤖 Agent Actions

Implemented the HackTricks update:

• Added a technique-focused Linux kernel exploitation page covering the futex PI UAF chain, pipe_buffer physical R/W, workqueue/usermode-helper escalation, safe cleanup, DEFEX bypass, and BTF/QEMU porting workflow.
• Added navigation entries to src/SUMMARY.md and Android Applications Pentesting.
• Included numbered citations to the original IonStack research, Mobile Hacking Lab blog/PoC, and Samsung DEFEX documentation.

Validation passed for paths, citations, references, formatting, forbidden sources, and git diff --check. mdbook was unavailable, so a full build could not be run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://mobilehackinglab.com/blog/cve-2026-43499-ghostlock-a17-root-shell

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation > Linux kernel exploitation, with a cross-reference from Mobile Pentesting > Android Applications Pentesting; suggested page: Futex PI UAF, pipe_buffer physical R/W, and workqueue/usermode-helper privilege escalation (CVE-2026-43499 Ghostlock)".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0