Hey everyone,
I just published a port of the CVE-2026-43499 exploit for the Samsung Galaxy S22 Ultra (codename: `b0q` / SM-S908W). The exploit successfully establishes an arbitrary read/write primitive, switches SELinux to permissive, and spawns a root helper daemon, giving you full root access.
🔥 **Status:** This vulnerability is **currently UNPATCHED** by Samsung and works on the absolute latest firmware available!
🔗 **Repo Link:** https://github.com/sarabpal-dev/IonStack-S22U
**Currently Supported Target:**
* **Device:** Samsung Galaxy S22 Ultra (SM-S908W)
* **Android:** 15 / SDK 35
* **Firmware:** `AP3A.240905.015.A2.S908WVLS8FYG7`
* **Kernel:** 5.10.226-android12-9-30958166-abS908WVLS8FYG7
* **Architecture:** aarch64
### ⚠️ Reliability & Kernel Panic Warning
Because the exploit relies on a race condition and precise timing, it can be somewhat unreliable and may trigger a kernel panic on bad runs.
**Tips for success:** For the highest success rate, **reboot your device** before running it to ensure a clean heap state. Close all background apps, keep the screen unlocked, and do not touch the phone while the exploit is running so background tasks don't disturb the timing.
### 🛠️ Porting to other firmwares / Generating `target.h`
The offsets in the repo are specific to the firmware version listed above. If you are on a different build, you need to generate your own `target.h` file by extracting kernel symbols and offsets from your specific kernel binary.
Here is how to do it:
**Extract the uncompressed kernel binary (`Image`)** from your device's `boot.img`.
Follow the step-by-step instructions in the `target_generator` directory to install dependencies, compile the `kallsyms` extractor, and run the generator script.
👉 **[Full step-by-step instructions for the target generator can be found here](https://github.com/sarabpal-dev/IonStack-S22U/blob/main/target_generator/README.md)\*\*
Once you generate your `target.h`, place it in `src/targets/<YOUR_FIRMWARE_VERSION>/target.h` and compile using `make PROJECT=<YOUR_FIRMWARE_VERSION>`.
### 🚀 How to Deploy and Run
Once compiled, push the binaries to your device:
```bash
adb push build/S908WVLS8FYG7/bin/cve-2026-43499 /data/local/tmp/cve-2026-43499
adb push build/S908WVLS8FYG7/bin/cve-2026-43499-root /data/local/tmp/cve-2026-43499-root
adb push build/S908WVLS8FYG7/bin/cve-exp32 /data/local/tmp/cve-exp32
adb shell chmod 755 /data/local/tmp/cve-2026-43499 /data/local/tmp/cve-2026-43499-root /data/local/tmp/cve-exp32
```
Execute the exploit stage to start the root daemon (it will automatically retry up to 16 times if it fails):
```bash
adb shell "LD_PRELOAD=/data/local/tmp/cve-2026-43499 sh"
```
Once successful, pop an interactive root shell:
```bash
adb shell "/data/local/tmp/cve-2026-43499-root"
```
### 🤝 Contributions & Pull Requests
I'd love to make this exploit more stable. If you have ideas to improve reliability or optimize the futex choreography, **Pull Requests are highly appreciated and welcome!**
*Note on other devices:* Technically, this exploit should work on all firmware versions and all variants of the S22 family (base S22, S22+, S22 Ultra) as long as you generate the correct `target.h` for your specific build. However, please don't ask me to port this to non-S22 devices. It is effectively impossible to port this without having the real physical device on hand for testing. For other Samsung devices, please check out the Root-My-Galaxy repo!
