CVE-2026-43499: Exploit for Use After Free in Linux Linux_Kernel CVE-2026-43499

Overview Sources History

What happened

Local privilege escalation in Linux kernel rtmutex remove_waiter via use-after-free.

Affected versions

Linux: 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 through before f3fa3424bceb128d2be4b3745506b22844b87db7 (git); 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 through before 838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd (git); 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 through before d8cce4773c2b23d819baf5abedc62f7b430e8745 (git); 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 through before 8a1fc8d698ac5e5916e3082a0f74450d71f9611f (git); 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 through before 6d52dfcb2a5db86e346cf51f8fcf2071b8085166 (git); 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 through before 3fb7394a837740770f0d6b4b30567e60786a63f2 (git); 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 through before 88614876370aac8ad1050ad785a4c095ba17ac11 (git); 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 through before 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 (git); 2.6.39; V3.1.6 through before * (custom); V3.1.7 through before * (custom); before * (custom) Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

Review the original advisory and validate affected versions.
Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference

SploitusLocal privilege escalation in Linux kernel rtmutex remove_waiter via use-after-free.cyrrp2026-10-09T18:08:47Verified cyrrp/honor90-ghostlockLocal privilege escalation in Linux kernel rtmutex remove_waiter via use-after-free.cyrrp2026-10-09T18:08:47Verified CVE-Intel · BuSung-dev/Root-My-GalaxyKSU installer for supported Samsung Galaxy firmware with CVE-2026-43499ExploitKotlinHIGHAwaiting Analysis★ 925⑂ 185EPSS 0.77%CVE data: CNACode indexedUpdated 26 Aug 2026BuSung-dev2026-07-17Candidate CVE-Intel · rsyzee/ghostlock-infinix-hot70Proof-of-concept kernel exploit for GhostLock (CVE-2026-43499) on the Infinix Hot 70.PoCHIGHAwaiting Analysis★ 0⑂ 0EPSS 0.77%CVE data: CNAUpdated 26 Aug 2026rsyzee2026-08-26Candidate CVE-Intel · JoinChang/ghostlock-oneplusGhostLock (CVE-2026-43499) kernel exploit for OnePlus devices with locked bootloaderExploitCHIGHAwaiting Analysis★ 284⑂ 60EPSS 0.77%CVE data: CNACode indexedUpdated 26 Aug 2026Tags: android, coloros, ghostlock, kernelsu, oneplus, rootJoinChang2026-07-12Candidate CVE-Intel · alex193a/Root-My-PixelJailbreak supported Google Pixel phones with CVE-2026-43499ExploitKotlinHIGHAwaiting Analysis★ 217⑂ 44EPSS 0.77%CVE data: CNACode indexedUpdated 26 Aug 2026Tags: cve, exploit, google, jailbreak, pixel, rootalex193a2026-08-02Candidate CVE-Intel · yakidango-official/GhostLock-H80GTHonor 80 GT privilege escalation PoC: GhostLock (CVE-2026-43499) + custom KernelSU module loadingLPECHIGHAwaiting Analysis★ 3⑂ 3EPSS 0.77%CVE data: CNACode indexedUpdated 26 Aug 2026yakidango-official2026-08-23Candidate CVE-Intel · Linuxoid-cn/CVE-2026-43499-Poc-AnalysisVulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only.PoCCHIGHAwaiting Analysis★ 77⑂ 24EPSS 0.77%CVE data: CNACode indexedUpdated 26 Aug 2026Linuxoid-cn2026-07-14Candidate CVE-Intel · CakesTwix/Android-CVE-2026-43499Android version CVE-2026-43499 testerExploitKotlinHIGHAwaiting Analysis★ 59⑂ 8EPSS 0.77%CVE data: CNACode indexedUpdated 26 Aug 2026CakesTwix2026-07-13Candidate CVE-Intel · JingMatrix/pixel-ksu-rootadb-driven KernelSU loader for stock Google Pixel: temporary kernel R/W via CVE-2026-43499 (GhostLock), then late-loads a signature-matched kernelsu.ko for the running KMI. Manager-agnostic.ExploitCHIGHAwaiting Analysis★ 8⑂ 2EPSS 0.77%CVE data: CNACode indexedUpdated 26 Aug 2026JingMatrix2026-08-25Candidate SploitusRoot My Galaxy repository providing native payloads and exploits for Galaxy devices.clay-rip2026-10-14T05:24:02Candidate clay-rip/rmgp-PayloadsRoot My Galaxy repository providing native payloads and exploits for Galaxy devices.clay-rip2026-10-14T05:24:02Candidate SploitusSamsung Root Kit — Offline Version provides two privilege escalation chains.shangu20032026-10-14T12:34:01Verified shangu2003/SamsungRootKitSamsung Root Kit — Offline Version provides two privilege escalation chains.shangu20032026-10-14T12:34:01Verified SploitusSamsung Root Kit provides two chains for privilege escalation to root.shangu2003-22026-10-16T02:12:35Verified shangu2003-2/SamsungRootKitSamsung Root Kit provides two chains for privilege escalation to root.shangu2003-22026-10-16T02:12:35Verified SploitusFully automated runtime LKM root for Honor MagicPad3 using a Use After Free in Linux.saltlyfish6662026-10-16T07:04:59Verified saltlyfish666/magicpad3-root-researchFully automated runtime LKM root for Honor MagicPad3 using a Use After Free in Linux.saltlyfish6662026-10-16T07:04:59Verified SploitusUAF in posix-cpu-timers: Prevent UAF caused by non-leader exec() race on OPPO Find X10 Pro Max.maosasagawa2026-10-17T08:31:09Verified maosasagawa/pmx110-cve-2026-64560UAF in posix-cpu-timers: Prevent UAF caused by non-leader exec() race on OPPO Find X10 Pro Max.maosasagawa2026-10-17T08:31:09Verified

Corrections Report an issue

Exploit for Use After Free in Linux Linux_Kernel CVE-2026-43499