Exploit for CVE-2026

Obtain temporary root access for the OnePlus Ace 6 through the CVE-2026-64560 (Linux kernel POSIX CPU timer UAF) vulnerability. This access is temporary and will expire after a restart; no changes are made to the system partition. > [!WARNING]

> May cause the device to restart or result in data loss. Use this tool only on your own device. Back up important data before proceeding. ## Supported Devices

| Firmware fingerprint | `OnePlus/PLQ110/OP6113L1:16/BP2A.250605.015/...` |

| Kernel version | `6.6.118-android15-8-...` |

If your system version fingerprint does not match, the tool will fail with the message `TARGET_PROFILE_GATE_FAIL`. ## Preparation Before Use

1. A OnePlus Ace 6 with the correct system version.

2. A computer (Windows / macOS / Linux is acceptable).

4. The phone must have **USB debugging** enabled: Settings → Phone → Connect version number 7 times to enable Developer Options → Developer Options → USB Debugging.

5. The computer must have `adb` installed ([Download link]( Extract it and add the path to the system’s PATH.

Go to the [**Releases page**]( of this repository and download the latest version of `cve-2026-64560-fanout-opace6`. Save the downloaded file to a place you can remember, such as your desktop.

Connect the phone to the computer using a USB cable. A window will pop up asking “Allow USB debugging”. Open a terminal (Windows: Win+R then cmd) and verify that the device is connected:

Your device’s serial number should be displayed, with the status being “device”. If it shows “unauthorized”, enable USB debugging on your phone.

adb push C:\Users\YourUsername\Desktop\cve-2026-64560-fanout-opace6 /data/local/tmp/

adb shell chmod 777 /data/local/tmp/cve-2026-64560-fanout-opace6

adb push ~/Desktop/cve-2026-64560-fanout-opace6 /data/local/tmp/

adb shell chmod 777 /data/local/tmp/cve-2026-64560-fanout-opace6

> **Note:** Permissions must be set to `777`; setting them to `755` will result in a “Permission denied” error.

Run the pre-check command to confirm that your device is ready:

adb shell /data/local/tmp/cve-2026-64560-fanout-opace6 --preflight

If you see “PREFLIGHT_PASS”, everything is working properly. If you see “TARGET_PROFILE_GATE_FAIL”, your system version does not match and the tool cannot be used.

This tool exploits a kernel race condition. It may require multiple attempts or even a restart. ### Method A: Using an Automatic Script (Recommended)

An automatic script will help you retry the process, including automatically restarting the device, waiting for cooling, and checking success.

Put the `scripts\boot-campaign.bat` file from this repository and the downloaded payload in the same folder. Then, run it in CMD by entering that folder:

`-n 6` means that up to 6 restart attempts will be made. The script will automatically:

- Execute the exploit and display progress (number of attempts).

- If it fails, restart the device to cool it down before retrying.

sh scripts/boot-campaign.sh -p cve-2026-64560-fanout-opace6 -n 6

(Optional: `-u cve-2026-64560-su` specifies the path for the temp-su. After success, the root session can be used across terminals.)

adb shell /data/local/tmp/cve-2026-64560-fanout-opace6 --run

If it doesn’t succeed (no `ROOT_SUCCESS` message appears), restart the device and try again. It’s recommended to wait until the device isn’t hot to try again. A high CPU temperature may reduce the success rate.

After success, you’ll see `ROOT_SUCCESS` or `ROOT_CHILD_HOLD_PASS`. The root shell is in the terminal where `--run` was executed. (The exploit will prompt “interactive root child; exit to finish”). Simply enter `id`, and if `uid=0(root)` is displayed, it means you’ve obtained root permissions. If you want to use root in another terminal, you need to make the root session persistent:

1. Obtain `cve-2026-64560-su` (not in the Release branch; see the repository [Actions build]( or compile it using the Android NDK with `src/temp-su.c`). Push it to the device:

adb push cve-2026-64560-su /data/local/tmp/su

2. Execute the command in the root shell:

3. Then, in any terminal, execute `/data/local/tmp/su` and enter `id` to verify. > **Note:** When using `boot-campaign.bat` or `boot-campaign.sh`, put `cve-2026-64560-su` and the payload in the same directory (or use `-u` to specify the path). The script will automatically push the file and start the daemon. > **Important:** Root permissions are only valid for this boot process. You need to run them again after the device restarts. > This won’t modify the boot, vendor, or system partitions, and won’t affect OTA updates.

Upstream: [NebuSec/CyberMeowfia]( Specific revisions and Linux fixes can be found in [docs/UPSTREAM.md](docs/UPSTREAM.md). Apache License 2.0; see [LICENSE](LICENSE) and [NOTICE](NOTICE).