Skip to content
Exploit for Use After Free in Linux Linux_Kernel

Exploit for Use After Free in Linux Linux_Kernel

Sploitus • September 26, 2026

./slide_dev 0x28000000 persist noslide neutral sweep 64 sweepstart=25 ownprobe shortseq

| `0x28000000` | this device's delta (XBL kernel load 0xA8000000 − P0_PHYS_OFFSET 0x80000000) |

| `noslide` / `neutral` | skip legacy walk-slide; neutralise page |

| `sweepstart=25` | start at grid cell 25 — a cell that has landed every boot on this device (phys 0xaccd7000) |

| `ownprobe` | pure userspace self-write probe (zero walk deaths) |

| `shortseq` | mini 3-write sequence: SELinux off → `real_cred`/`cred` = `init_cred` |

*Terms: a **grid cell** is one candidate physical address; a **death cell** is a

candidate that faults the kernel walk on this build.*

On success: `uid=0` → automatic `ksud late-load --kmi android12-5.10 --allow-shell` → KernelSU.

- **One boot, one run.** Placement and KASLR are fresh each boot; re-running in

the same boot lands on a disturbed memory map.

- **LKM is per-boot.** KernelSU disappears after reboot; re-run `run.sh`

(without touching boot.img you cannot auto-load at boot).

- **Never `insmod kernelsu.ko`** — it fails on ~40 unexported symbols; use

- Full mechanics and troubleshooting: `docs/TUTORIAL.md`.

`offsets/` holds the offset table for this kernel for frameworks that support

multi-device offset tables / runtime JSON import:

- `offsets-5.10.205.json` — runtime JSON format (`symbols` + `struct_fields`).

- `5.10.205-offsets.h` — C header format (`STRUCT_OFFSETS_5_10` entry).

Note: the 5.10 `rt_mutex_waiter` is a **10-word flat** layout

(`tree/pi_tree/task/lock/prio/deadline`), different from 6.1/6.6; a consumer

needs a matching waiter branch (word10 = plain prio, no `ww_ctx`).

MIT (see `LICENSE`). **Authorized security research only.**

See `docs/CREDITS.md` — and `docs/ROADMAP.md` for what we tried and what finally worked.

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)

Tools (2)