Porting GhostLock (CVE-2026-43499) to the Samsung Galaxy A17: KDP, DEFEX, and the art of not panicking

Researchers at Mobile Hacking Lab adapted the public CVE-2026-43499 GhostLock chain to a stock Samsung Galaxy A17 (SM-A175F) running GKI 6.12.23-android16.

The existing exploit chain turns a futex PI use-after-free into constrained kernel writes and then, through forged pipe_buffer objects, into arbitrary physical-memory read/write. Those primitives carried over to the Galaxy A17. The harder part was turning them into a stable root shell under Samsung-specific mitigations.

• KDP blocked direct credential patching. Modifying the current process cred structure no longer worked because KDP protects sensitive kernel data from EL1 writes. Instead, the exploit forged a workqueue item and redirected execution into the usermode-helper path, causing the kernel to launch a process with init credentials without modifying cred directly.

• panic_on_oops=1 made cleanup fatal. Forged pipe_buffer entries referenced reserved kernel-image pages. When the pipes were released, anon_pipe_buf_release() eventually triggered a bad-page condition and rebooted the device. The port keeps the relevant file descriptors alive in a forked process and clears the ops field of forged slots before teardown.

• DEFEX blocked the final root binary. A UID 0 process could not execute g4d directly from /data/local/tmp. The helper instead bind-mounted g4d over /system/bin/lmkd and launched it through the trusted system path. The daemon then exposes the root shell over the abstract Unix socket @ghostlockd.

The result is a stable root shell on a retail Galaxy A17 with the stock firmware and a locked bootloader. The access persists for the current boot; after a reboot, the exploit chain must be run again.

Article: https://www.mobilehackinglab.com/blog/cve-2026-43499-ghostlock-a17-root-shell