Shadowgraph
TrendingAbout
Sign in

CakesTwix/Android-CVE-2026-43499

Android version CVE-2026-43499 tester

Kotlin

77

3 commits

updated Jul 20, 2026

See the code

See what people are saying (1)

SourceMessageScoreDate

Android 17 is the first since 3.x to add new APIs without releasing to the AOSP

I just ran https://github.com/CakesTwix/Android-CVE-2026-43499 on my Pixel 9 Pro and it seems to have been patched. I did get a system update not long ago, though.

0

Sep 18, 2026

README

CVE-2026-43499 Detector

Android app that detects the kernel vulnerability CVE-2026-43499 — a use-after-free in rtmutex triggered via futex_requeue.

Vulnerability

CVECVE-2026-43499
TypeUse-after-free
Componentkernel/locking/rtmutex.c
Triggerfutex_requeue → proxy-lock rollback in remove_waiter() uses current instead of waiter->task
CVSS7.8 (HIGH)
AffectedLinux 2.6.39 – 6.1.174
Patched6.18.27+, 6.12.86+, 6.6.140+, 6.1.175+

How it works

  1. Checks kernel version against known-patched releases. If the kernel is at or above a patched version, reports safe immediately.
  2. Otherwise, runs a native PoC binary (shipped via jniLibs, executed from nativeLibraryDir).
  3. For 5 attempts:
    • Starts the binary
    • Waits 5 seconds
    • Sends SIGTERM
    • Waits 5 seconds for the process to die
  4. If the process survives SIGTERM in any attempt (stuck in D-state) → vulnerable.
  5. If all 5 attempts are killable → patched.
  6. Waits an additional 5 seconds after the last attempt.

Binary bitness is auto-detected from Build.SUPPORTED_ABIS.

Requirements

  • Android 7.0+ (API 24)
  • ARM (32-bit build: armeabi-v7a)

Tech stack

  • Kotlin
  • Jetpack Compose
  • Material Deisgn 3
  • Single-activity architecture

Build

./gradlew assembleDebug

APK output: app/build/outputs/apk/debug/app-debug.apk

Kernel patches

KernelRepository
3.4acroreiser/android_kernel_lge_hammerhead
3.10acroreiser/android_kernel_lenovo_a6010
4.4acroreiser/android_kernel_samsung_universal8895
4.9Lenovo-Z5s/android_kernel_lenovo_sdm710
4.4 ~ 5.10oracle/linux-uek/uek6
5.15oracle/linux-uek/uek7

Warning

Running the test on a vulnerable device may cause a kernel crash or spontaneous reboot. Proceed at your own risk.

Contributors

CakesTwix

2 commits

backslashxx

1 commits

Similar repos

FreeXR/exploits

Information on known exploits

24

JoinChang/ghostlock-oneplus

GhostLock (CVE-2026-43499) kernel exploit for Android devices with locked bootloader

342

alex193a/Root-My-Pixel

Jailbreak supported Google Pixel phones with CVE-2026-43499

382

bmax121/APatch

The patching of Android kernel and Android system

7,949

BuSung-dev/Root-My-Galaxy-Payloads

Signed device profiles, mobile exploit payloads, and KernelSU artifacts for Root My Galaxy

429

tiann/KernelSU

A Kernel based root solution for Android

18,458

rsuntk/KernelsU

Personal fork of KernelSU Project

658

KernelSU-Next/KernelSU-Next

An advanced Kernel based root solution for Android

4,267

Languages

Kotlin

100.0%

CakesTwix/Android-CVE-2026-43499

Android version CVE-2026-43499 tester

Kotlin

77

3 commits

updated Jul 20, 2026

See the code

See what people are saying (1)

SourceMessageScoreDate

Android 17 is the first since 3.x to add new APIs without releasing to the AOSP

I just ran https://github.com/CakesTwix/Android-CVE-2026-43499 on my Pixel 9 Pro and it seems to have been patched. I did get a system update not long ago, though.

0

Sep 18, 2026

README

CVE-2026-43499 Detector

Android app that detects the kernel vulnerability CVE-2026-43499 — a use-after-free in rtmutex triggered via futex_requeue.

Vulnerability

CVECVE-2026-43499
TypeUse-after-free
Componentkernel/locking/rtmutex.c
Triggerfutex_requeue → proxy-lock rollback in remove_waiter() uses current instead of waiter->task
CVSS7.8 (HIGH)
AffectedLinux 2.6.39 – 6.1.174
Patched6.18.27+, 6.12.86+, 6.6.140+, 6.1.175+

How it works

  1. Checks kernel version against known-patched releases. If the kernel is at or above a patched version, reports safe immediately.
  2. Otherwise, runs a native PoC binary (shipped via jniLibs, executed from nativeLibraryDir).
  3. For 5 attempts:
    • Starts the binary
    • Waits 5 seconds
    • Sends SIGTERM
    • Waits 5 seconds for the process to die
  4. If the process survives SIGTERM in any attempt (stuck in D-state) → vulnerable.
  5. If all 5 attempts are killable → patched.
  6. Waits an additional 5 seconds after the last attempt.

Binary bitness is auto-detected from Build.SUPPORTED_ABIS.

Requirements

  • Android 7.0+ (API 24)
  • ARM (32-bit build: armeabi-v7a)

Tech stack

  • Kotlin
  • Jetpack Compose
  • Material Deisgn 3
  • Single-activity architecture

Build

./gradlew assembleDebug

APK output: app/build/outputs/apk/debug/app-debug.apk

Kernel patches

KernelRepository
3.4acroreiser/android_kernel_lge_hammerhead
3.10acroreiser/android_kernel_lenovo_a6010
4.4acroreiser/android_kernel_samsung_universal8895
4.9Lenovo-Z5s/android_kernel_lenovo_sdm710
4.4 ~ 5.10oracle/linux-uek/uek6
5.15oracle/linux-uek/uek7

Warning

Running the test on a vulnerable device may cause a kernel crash or spontaneous reboot. Proceed at your own risk.

Similar repos

FreeXR/exploits

Information on known exploits

24

JoinChang/ghostlock-oneplus

GhostLock (CVE-2026-43499) kernel exploit for Android devices with locked bootloader

342

alex193a/Root-My-Pixel

Jailbreak supported Google Pixel phones with CVE-2026-43499

382

bmax121/APatch

The patching of Android kernel and Android system

7,949

BuSung-dev/Root-My-Galaxy-Payloads

Signed device profiles, mobile exploit payloads, and KernelSU artifacts for Root My Galaxy

429

tiann/KernelSU

A Kernel based root solution for Android

18,458

rsuntk/KernelsU

Personal fork of KernelSU Project

658

KernelSU-Next/KernelSU-Next

An advanced Kernel based root solution for Android

4,267

Contributors

CakesTwix

2 commits

backslashxx

1 commits

Languages

Kotlin

100.0%