Exploit for CVE-2026

This project is a one-click temporary root tool for the Honor Magic6 Pro (BVL-AN16), implemented as an Android application. The app obtains shell privileges (uid 2000) via Shizuku, then leverages a UAF in the kernel to gain write access. It installs KernelSU modules matching the device’s kernel, making them appear installed in the system. No computer is required, no system image modification occurs, and no unlocking is needed. Please read the disclaimer at the end of this document prior to installation. ## Vulnerability Used

The privilege escalation relies on **CVE-2026-98260**: the Linux kernel contains a use-after-free (UAF) issue when `exec()` handles non-main threads and POSIX thread-level CPU timers; this vulnerability is referred to in public reports as “Infinity Core” timer issues. | Item | Value |

| Type | Kernel UAF: `exec()` non-main thread + thread-level CPU timer |

| Score | CVSS v3.1 7.8 (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`) |

| Introduced/Fixed | `55e8c8eb2c7b` (v5.7 onward) → `acb03d388181` (7.3-rc4) |

| Backported | 6.6.158, 6.12.112, 6.18.54, 7.2.8 |

| Local context | 6.1.157 falls under the non-backported branch, thus it is affected |

The exploitation process consists of two stages: first, the UAF is exploited to achieve controlled kernel write access, which then allows modification of the credentials structure (cred) to obtain an execution environment with uid 0. In this environment, run `kgo.sh` to install the kernel module. The system image remains unchanged; no traces of the module persist after a reboot. ## Usage steps

2. Install the APK provided in the Releases section and open it.

3. Select the manager and route, then click “Privilege escalation”.

4. After completion, restart the manager; it will indicate that the module has been installed. For the first use, verify that “Kernel verification” on the status card reads “Match”. If it shows “Mismatch”, the current module is not suitable for this device, and privilege escalation should not be attempted. ## Download

The [Releases]( provide the built APK: `M6Shell-9.31.1-public.apk`, which weighs 13.8 MB. The payload within the package matches the files in this repository, so no additional preparation is required. Starting from version 9.31, the signature certificate has been updated (the old certificate included province and city fields); thus, when upgrading from version 9.30 or earlier, uninstallation must precede installation, otherwise `INSTALL_FAILED_UPDATE_INCOMPATIBLE` will occur. Uninstalling the app does not remove any loaded kernel modules nor affect `/data/adb`. Version 9.31 has been withdrawn: this version contains an exploit without stripping, along with the username and path of the build machine. Version 9.31.1 represents a rebuilt version. ## Running conditions and risks

This tool exploits kernel vulnerabilities to achieve privilege escalation. During execution, the device may reboot or become unresponsive; in severe cases, it might fail to boot at all. Before using it, ensure the device has available recovery methods and test it on a personal device first. ## Repository contents

│ │ ├── MainActivity.kt Interface: status card, route selection, advanced settings, kernel logs

│ │ ├── Deployer.kt Full deployment and privilege escalation process

│ │ ├── Kernels.kt Selects ko based on uname -r

│ │ ├── KoPatcher.kt Modifies version numbers reported by ko

│ │ ├── ShizukuShell.kt Shizuku command channel

│ │ ├── SepolicyOracle.kt SELinux probe

│ │ ├── AppZygoteProbe.kt Executes probes as app_zygote

│ ├── res/ Layouts, colors, strings, icons

│ ├── exploit-1021f … exploit-1022o 14 aarch64 executables, stripped

│ ├── kgo.sh postw.sh Kernel-side scripts

│ ├── ksud load_ko patcher su98260 Device-side tools

│ ├── kernelsu.ko Default package

│ ├── kernelsu-g84ffa64b710b.ko Two versions differentiated by kernel

│ ├── me.yuki.fina/ FinaSU, the only one with SELinux hidden patches

│ ├── com.sukisu.ultra/ │ ├── com.rifsxd.ksunext/

│ └── me.weishu.kernelsu/ Each directory contains 3 ko files with the same name.

├── native/patcher.c Modified C source code for ko __versions.

├── scripts/ pack_variants.sh / strip_ko.py / patch_kgo_diag.py

├── build.gradle.kts settings.gradle.kts gradle.properties

All `exploit-*` files have been processed using `llvm-strip --strip-debug`; their size has been reduced from 2.4 MB to 0.6 MB. The debug sections have been removed; no changes were made to the code segments (`.text`, `.rodata`, and `.data` remain identical to the unstripped version). Ko files are not stripped because `patcher` relies on version numbers reported via its symbol table. The order in which ko files are selected is as follows:

echo "sdk.dir=/path/to/Android/Sdk" > local.properties

JDK 17 and the Android SDK (compileSdk 36, minSdk 26) are required. Signature information is read from `keystore.properties` located at the project root; if this file is missing, only unsigned packages can be generated. `checkKoAssets` checks for any experimental ko files within the assets; these must not appear, and the project’s own modules must include the `selinux_setprocattr` flag.

| Manager | `g84ffa64b710b` | `g7db56fb8f741`（SP7） |

| FinaSU 1.5.0 | Privilege escalation successful; DirtySepolicy reports `OK: no dirty sepolicy found` | Only static verification |

| SukiSU Ultra | Privilege escalation successful | Only static verification |

| KernelSU- | Privilege escalation successful | Only static verification |

| BakaSU | Privilege escalation successful | Only static verification |

| KernelSU | Privilege escalation successful | Only static verification |

“Static verification” refers to modules where vermagic matches the kernel version, module version numbers align with the manager’s versionCode, and the manager’s reporting functions are present within the module. No test devices are available for SP7, so real-world validation cannot be performed. ## Known Limitations

Only FinaSU includes a SELinux hidden patch. After privilege escalation using the other four managers, DirtySepolicy re-reports indicators such as `found KernelSU`, `system_server can execmem`, which are intentionally retained as part of the design trade-offs. Binaries after stripping lack debug information; if an exploit fails on a device, it becomes impossible to retrieve symbols or line numbers, necessitating reverting to unstripped versions for reproduction. ## Related Repositories

- [V4bel/InfinityCore]( — upstream reports and public PoCs related to CVE-2026-98260 (Ubuntu desktop edition)

- [m6-os11-ksu]( — Build source for ko in `assets`: compilation of two kernel files, `__versions` patch, and self-check scripts

Upstream projects for the five managers under `assets/variants`:

- [tiann/KernelSU]( — `me.weishu.kernelsu` - [KernelSU- /KernelSU- ]( —— `com.rifsxd.ksunext`

- [SukiSU-Ultra/SukiSU-Ultra]( —— `com.sukisu.ultra`

- [Baka-SU/BakaSU]( —— `com.resukisu.resukisu`

- [LyraVoid/FinaSU]( —— `me.yuki.fina`

The code for porting and exploiting CVE-2026-98260 on the local machine (version 6.1.157) is not publicly available; the `assets/exploit-*` files in this repository serve as executable artifacts. ## Disclaimer

1. **Actual actions and reversibility**: This tool obtains root privileges, loads kernel modules onto the device, and writes files to `/data/adb` and `/data/local/tmp/.w9`. These modifications cannot be automatically undone by the tool, nor can uninstalling the app remove previously loaded modules.

2. **Limitations of validation mechanisms**: Module selection relies on three checks: vermagic, package name, and version number. This only prevents loading incorrect modules; it does not guarantee successful privilege escalation. Which manager to use and which path to follow is entirely up to the user.

3. **No affiliation with manufacturers**: This project is an independent research effort; it has no relation to Honor or the authors of KernelSU-based managers. It does not represent any official application and must not be used to impersonate others or induce installation.

4. **Responsibility**: Any device malfunctions, data loss, or invalidation of warranties are solely the user’s responsibility. Use this tool only on devices you own or have explicit authorization to use; unauthorized access to others’ devices is illegal in most jurisdictions.

5. **Licensing**: This project is released under GPL-3.0; no guarantees are provided. Details are found in Sections 15 and 16 of the `LICENSE`. ## Licensing

GPL-3.0. Runtime kernel modules and toolchains originate from KernelSU-related projects and are distributed under their respective licenses.