⚠️WARNING

This project is deprecated. Please use DFRoot instead.

Do not use this release unless you specifically need CVE-2026-43499.

DFRoot uses CVE-2026-43284 and provides a much more generic and maintainable rooting method without per-build offset adaptation.

This project is no longer recommended for normal use and may not receive further updates.

GhostLock (CVE-2026-43499) for Galaxy Z Fold 8 (h8q) / Fold 8 Ultra (q8q)

Most of this code is based on @polygraphene's fork of the original. Heavy modifications were required because the main primer used (select()) for most published variants of the exploit does not properly align with the rt_mutex_waiter struct on these 6.12 Samsung targets. io_submit() is used instead.

Working: h8q.

Build

git clone (this repo)
cd (this repo)
export ANDROID_NDK_ROOT=(your ndk path)
make

After rebuilding ksud, rebuild GhostLock and refresh the APK assets:

cd /home/soragoto/work/ghostlock-h8q
export ANDROID_NDK_ROOT=/home/soragoto/work/android-sdk/ndk/29.0.14206865
make clean && make
cp /home/soragoto/work/KernelSU-polygraphene-a553176/target/aarch64-linux-android/release/ksud build/ksud
cp build/preload.so apk/app/src/main/assets/preload.so
cp build/ksud apk/app/src/main/assets/ksud
cd apk && ./gradlew clean assembleRelease --no-daemon

The APK is written to apk/app/build/outputs/apk/release/app-release.apk.

Build ksud + kernelsu.ko using this tree by polygraphene and following this instruction. This tree contains a patch from BuSung-dev/Root-My-Galaxy and 6.12 adaptation.

Run

$ adb install /path/to/KernelSu_Manager.apk
$ adb push build/preload.so /data/local/tmp/
$ adb push /home/soragoto/work/KernelSU-polygraphene-a553176/target/aarch64-linux-android/release/ksud /data/local/tmp/
$ adb shell env LD_PRELOAD=/data/local/tmp/preload.so sh -c 'echo PWND'

Acknowledgments

• @polygraphene: Most of this code is based on his fork of the original for compatibility with Samsung devices running kernel 6.12
• Nebula Security: Vulnerability and original exploit
• @lukasmaar: This exploit is heavily dependent on kernelsnitch
• @diabl0w: q8q io_submit primer
• BuSung-dev: Samsung KDP/RKP/DEFEX KernelSU patch