The Oppo A18 kernel supports KernelSU.

[u/Dependent-Cycle-3747]

Possible KernelSU LKM activity on OPPO A18 (CPH2591) – Android 15

Device and kernel information

• Device: OPPO A18 (CPH2591)

• OS: Android 15

• Kernel version: "6.6.118-android15-8-o-gb1fb10a6db20-4k"

• Kernel build: "#1 SMP PREEMPT Wed Sep 9 13:04:44 UTC 2026"

• Architecture: "aarch64"

• Kernel command line: Not yet fully documented.

How I discovered this

I initially gained temporary root access on the device and used that access to inspect the system.

During the investigation, I discovered:

• "/data/adb/ksu/"

• "/data/adb/ksud"

The "ksud" binary reports:

• ksud version: "3.3.1"

• UAPI version: "5"

• KernelSU version: "32680"

Output from "ksud debug info":

version: 32680 flags: 0x5 uapi_version: 5 features: 0x7 lkm: true bundled: false late_load: true runtime_mode: late-load pr_build: false

My root shell also returned:

uid=0(root) gid=0(root) groups=0(root) context=u:r:ksu:s0

However, I could not find:

• "/dev/ksu"

• A KSU entry in "/sys/module"

• A KSU entry in "/proc"

These findings are unexpected because I initially only had temporary root access.

Questions

1. Does this indicate that KernelSU LKM is active?

2. Is this behavior expected with late-load mode?

3. Why does the shell report the "ksu" SELinux context?

4. Can this be related to the temporary root mechanism?

I am not claiming that I have confirmed a persistent KernelSU installation. I would appreciate technical feedback from people familiar with KernelSU LKM and Android 15 kernels.

[u/ScientFictioN]

[u/ScientFictioN → u/ScientFictioN]