Exploit for CVE-2026

CVE-2026-98260 is a vulnerability that has been patched and exploited on the Honor Magic6 Pro (BVL-AN16).

Target kernel: `6.1.157-android14-11-g84ffa64b710b`, which grants privilege escalation from the `untrusted_app` domain to UID 0.

Upstream vulnerability reports and a proof-of-concept for Ubuntu can be found at [V4bel/InfinityCore](

This repository contains only implementations, configuration notes, and migration methods applied to this kernel version.

The Linux kernel suffers from use-after-free (UAF) when handling **non-main threads** and **thread-level POSIX CPU timers** via `exec()`.

Upstream reports describe this as an “Infinity Core” timer issue.

| Type | Kernel UAF: `exec()` non-main thread + thread-level CPU timer |

| Score | CVSS v3.1 7.8 (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`) |

| Introduced/Fixed | `55e8c8eb2c7b` (starting from v5.7) → `acb03d388181` (7.3-rc4) |

| Backported | 6.6.158, 6.12.112, 6.18.54, 7.2.8 |

| Target | Version 6.1.157 is unbackported; thus it can be exploited. |

| Device | Honor Magic6 Pro (BVL-AN16, SM8650) |

| Kernel | `6.1.157-android14-11-g84ffa64b710b` |

| Requirement | Domain capable of executing files within its own data directory; `untrusted_app_27` with `targetSdk` 26–28 must have `execute_no_trans`. |

| Remediation | For other kernels, offsets and slab parameters must be recalculated; see “Migration” below. |

The script utilizes `aarch64-linux-android24-clang` with the following parameters: `-O2 -g -static -pthread -DPC98260_TARGET_6157`.

Upon completion of compilation, `scripts/fix_tls_align.py` is invoked to change the `p_align` value in `PT_TLS` from 8 to 64. Bionic only accepts alignments of 64 or higher; if this change is not made, `exec` fails immediately:

The executable’s TLS segment is underaligned: alignment is 8 (skew 0),

./exploit --check # Performs environment check only; no writes performed

./exploit --no-real-cred # Official exploitation mode: uses B2 layout without constructing real credentials

| `--check` | Performs an environment check, printing information available slabs, timers, and carriers |

| `--quick` | Shortens the wait time, useful for quickly verifying whether the trigger conditions are met |

| `--slide` | Directly specifies the KASLR slide, bypassing the leakage phase |

| `--no-real-cred` | Skips writing actual credentials; instead uses the B2 layout (the default approach in this repository) |

| `--cred-init` | Enters the “cred” initialization path, which conflicts with B2 usage |

| `--no-selftest` | Skips post-write self-checking |

| `PC98260_SLIDE` | Same as `--slide`; used as a parameter in scripts |

| `PC98260_PRESSURE_KB` | Target memory pressure level (in KB); `auto` means setting to 4.8 GB available | | `PC98260_LOCKERS` / `PC98260_CHURN_PER_CPU` / `PC98260_CHURN_ROUNDS` | Configuration related to hit rate |

| `PC98260_MAX_ATTEMPTS` / `PC98260_WAIT_CAP_S` / `PC98260_BUDGET_S` | Number of retries and timeout budget |

| `PC98260_B2` / `PC98260_B_NODE` | Two layout selection switches |

| `PC98260_SOCK` | Socket path for the root daemon |

| `PC98260_NO_FALLBACK` / `PC98260_SLOW_FALLBACK` | Disabling or delaying fallback paths |

The full list can be found in the `getenv` calls within `src/uaf_plant_61258.c`. ## Porting

1. **Calculate offsets**: `scripts/btf_offsets.py` extracts structure member offsets from the device’s `vmlinux.btf`, then fills them into `src/pc98260_target_6157.h`. Existing BVL-AN16 offsets are documented in `docs/btf_offsets_bvl_an16.md`.

2. **Test slabs**: Object size, `cpu_partial`, and `min_partial` must be re-evaluated using the methods outlined in `docs/p2_slab_params_bvl_an16.md`. When parameters don’t match, no errors occur; it simply results in a no-hit condition.

3. **Verify triggers**: Use `--check` and `--quick` first to confirm that the trigger section is active before proceeding with the full process. `docs/p3_aio_prereq.md` details the validation methods for writeability of AIO ring pages.

4. **Review layouts**: `docs/b_variant_cleanup_replay.md` provides step-by-step demonstrations of the B2 layout. It’s advisable to read this document prior to making any layout changes. ## Files

│ ├── uaf_plant_61258.c Triggering, leaking, writing, and finalizing operations

│ ├── pc98260_target.h Target description interface

│ ├── pc98260_target_6157.h Offsets and constants for BVL-AN16 / 6.1.157

│ ├── rootd.c Root daemon launched after uid 0

│ ├── kread.c Kernel memory reading

│ ├── memhog.c Memory pressure and slab sizing

│ ├── su98260.c Root channel client

│ └── stubs.c Stubs required for static linking

│ ├── build.sh Compile and fix TLS alignment

│ ├── fix_tls_align.py Modify PT_TLS’s p_align

│ └── btf_offsets.py Minimal BTF parser, used solely for offset calculation

├── docs/ Migration notes, slab parameters, layout analysis, parameter configuration records

├── LICENSE Apache-2.0

- This kernel version has been verified for use only. Other models and kernels require manual migration; a single offset error can cause a panic.

- Required target kernel configurations: `KPROBES`, `KALLSYMS_ALL`, and `DEBUG_INFO_BTF` must be enabled. - It triggers a dependency on memory state; the success rate is not 100%. In practice, the highest success rate occurs around `PC98260_PRESSURE_KB=4800000`. When there are consecutive failures, the script retries, but this consumes time.

- Writing failures may leave the system in an intermediate state. A reboot can clear traces in user space, but any modifications made to the kernel remain intact.

- [V4bel/InfinityCore]( — Upstream reports and public PoCs

- [m6-shell]( — Android applications that call this exploit (Shizuku + module loading)

- [m6-os11-ksu]( — Building and patching the KernelSU module on the same machine

1. **Actual behavior and reversibility**: This program modifies kernel memory, gains a UID of 0, and may load kernel modules. These changes cannot be automatically undone; a reboot only clears certain user-space traces.

2. **Boundary of validation mechanisms**: The offsets and constants used in the code apply only to the kernel identified in the manifest. Running the program on other kernels results in no errors—only panics or silent failures.

3. **No affiliation with manufacturers**: This project is an independent research effort; it has no relation to Honor or its authors, and does not represent any official implementation.

4. **Responsibility**: Any damage to hardware, data loss, or invalidation of warranties is solely the user’s responsibility. Use only on devices you own or have explicit authorization to use; unauthorized access to others’ devices is illegal in most jurisdictions.

5. **Licensing**: This project is released under Apache-2.0; no guarantees are provided. Details are found in Sections 7 and 8 of the `LICENSE`.