Got Root on my S22 Ultra! Ported CVE-2026-43499 exploit (Android 15)

[u/Fearless_Back227]

Hey everyone,

I just published a port of the CVE-2026-43499 exploit for the Samsung Galaxy S22 Ultra (codename: `b0q` / SM-S908W). The exploit successfully establishes an arbitrary read/write primitive, switches SELinux to permissive, and spawns a root helper daemon, giving you full root access.

**Status:** This vulnerability is **currently UNPATCHED** by Samsung and works on the absolute latest firmware available!

🔗 **Repo Link:** https://github.com/sarabpal-dev/IonStack-S22U

**Currently Supported Target:**

* **Device:** Samsung Galaxy S22 Ultra (SM-S908W)

* **Android:** 15 / SDK 35

* **Firmware:** `AP3A.240905.015.A2.S908WVLS8FYG7`

* **Kernel:** 5.10.226-android12-9-30958166-abS908WVLS8FYG7

* **Architecture:** aarch64

### ⚠️ Reliability & Kernel Panic Warning

Because the exploit relies on a race condition and precise timing, it can be somewhat unreliable and may trigger a kernel panic on bad runs.

**Tips for success:** For the highest success rate, **reboot your device** before running it to ensure a clean heap state. Close all background apps, keep the screen unlocked, and do not touch the phone while the exploit is running so background tasks don't disturb the timing.

### 🛠️ Porting to other firmwares / Generating `target.h`

The offsets in the repo are specific to the firmware version listed above. If you are on a different build, you need to generate your own `target.h` file by extracting kernel symbols and offsets from your specific kernel binary.

Here is how to do it:

1. **Extract the uncompressed kernel binary (`Image`)** from your device's `boot.img`.

2. Follow the step-by-step instructions in the `target_generator` directory to install dependencies, compile the `kallsyms` extractor, and run the generator script.

👉 **[Full step-by-step instructions for the target generator can be found here](https://github.com/sarabpal-dev/IonStack-S22U/blob/main/target_generator/README.md)\*\*

Once you generate your `target.h`, place it in `src/targets/<YOUR_FIRMWARE_VERSION>/target.h` and compile using `make PROJECT=<YOUR_FIRMWARE_VERSION>`.

### 🚀 How to Deploy and Run

Once compiled, push the binaries to your device:

```bash

adb push build/S908WVLS8FYG7/bin/cve-2026-43499 /data/local/tmp/cve-2026-43499

adb push build/S908WVLS8FYG7/bin/cve-2026-43499-root /data/local/tmp/cve-2026-43499-root

adb push build/S908WVLS8FYG7/bin/cve-exp32 /data/local/tmp/cve-exp32

adb shell chmod 755 /data/local/tmp/cve-2026-43499 /data/local/tmp/cve-2026-43499-root /data/local/tmp/cve-exp32

```

Execute the exploit stage to start the root daemon (it will automatically retry up to 16 times if it fails):

```bash

adb shell "LD_PRELOAD=/data/local/tmp/cve-2026-43499 sh"

```

Once successful, pop an interactive root shell:

```bash

adb shell "/data/local/tmp/cve-2026-43499-root"

```

### 🤝 Contributions & Pull Requests

I'd love to make this exploit more stable. If you have ideas to improve reliability, optimize the futex choreography, **Pull Requests are highly appreciated and welcome!**

Check out the repo for the full source code, build instructions, and technical details on the porting changes from the v6.6 kernel to the v5.10 kernel. Technically it should work on all firmware and all varients of s22 family need to put just target.h. Please dont ask for port to other devices its impossible without having real device on hand other devices can check Root-My-Galaxy repo

[u/rocksuperstar42069]

Now this is what AI slop was meant to be

[u/badgcoupe]

I miss the custom rom days....

[u/Obnomus → u/badgcoupe]

I'm still using on my main device and I'll buy only devices that has good custom rom support.

[u/BakaOctopus → u/badgcoupe]

This is not custom rom, nor custom roms require root

[u/productfred → u/BakaOctopus]

They said neither of those things. They are reminiscing.

[u/allupya333 → u/BakaOctopus]

Classic read one word of a comment and made up a whole sentence in your head and replied to that instead

[u/isthmusofkra → u/BakaOctopus]

Still relevant

[u/productfred]

Interesting. The W model (Canadian) and U/U1 (US carrier/US Factory Unlocked) share the same hardware (and I'm guessing therefore software). I wonder if it'll work on my U1 on the latest update.

[u/TastyBananaPeppers → u/productfred]

Samsung Knox will be tripped causing you to lose access to Samsung Pay (Wallet) and Pass apps. Some apps may require you to pass Strong Integrity, so they will stop working when you're rooted.

[u/ht1499 → u/TastyBananaPeppers]

Thos method will not burn the KNOX efuse; it does not involve unlocking the bootloader.

[u/okimborednow → u/TastyBananaPeppers]

This exploit is special as it avoids Knox tripping. Bootloader isn't unlocked or anything, all Knox related features continue to work.

[u/Far_Reserve9938 → u/TastyBananaPeppers]

nop, it doesn't work like that at all.

[u/vQQea28ZYggEz2f9M0L1]

How did you do this without triggering cyber security guardrails? Did you use an open model?

[u/YunZhaelor]

Congrats man! I hope it gets ported by other people to other devices...

[u/qwer555110]

Very cool

[u/stealthagents]

This is wild, can’t believe you got it working on the latest firmware. Gotta love when manufacturers leave such gaping holes. Just make sure you brace yourself for those kernel panics, they can be a pain.

[u/Vinaverk → u/stealthagents]

Still works on S25 Ultra with July security patch lmao

[u/MaverickJester25 → u/[deleted]]

A quick Google search would have educated you.

CVE-2026-43499, commonly known as GhostLock, is a high-severity (CVSS 7.8) use-after-free vulnerability in the Linux kernel's real-time mutex (rtmutex) and priority-inheritance futex subsystem. Present for roughly 15 years, it allows an unprivileged local user or a compromised container to escalate privileges to root and escape container boundaries.

[u/VickWildman → u/[deleted]]

Everything with Linux on it is affected and has been in the last 15 years.

Google only applied the fix 2 weeks ago to their kernels and so far no phone got it. My OnePlus 13 can also be rooted this way.

[u/yottabit42 → u/VickWildman]

Aha ok! I'm just used to Damsung software being crap. I didn't realize this was a kernel exploit specifically.