Low Severity
CVE-2026-43284
Published: Oct 26, 2026
Ephemeral root for Samsung Galaxy devices via CVE-2026-43284 — stability fork of DirtyFrag. Reboot to undo.
<p align="center">
<img src="docs/assets/readme/hero.svg" alt="GalaxyCrash — an ESP transform writes the page cache, a patched libc++ runs shellcode as uid 0, a kernel module loads and ksud starts. Root on a locked bootloader, until reboot." width="100%">
</p>
<h1 align="center">GalaxyCrash</h1>
<p align="center"><strong>Root on a locked bootloader. No custom kernel, no Odin, no data wipe — and gone on reboot.</strong></p>
<p align="center">
<a href="https://github.com/RemiPelloux/GalaxyCrash/releases/latest"><img alt="Latest release" src="https://img.shields.io/github/v/release/RemiPelloux/GalaxyCrash?color=2b5cf0&labelColor=0b0f17&style=flat-square"></a>
<img alt="Android 12 to 17" src="https://img.shields.io/badge/Android-12%20%E2%80%93%2017-7fd1a8?labelColor=0b0f17&style=flat-square">
<img alt="arm64-v8a" src="https://img.shields.io/badge/ABI-arm64--v8a-8fa8bc?labelColor=0b0f17&style=flat-square">
<img alt="Ephemeral root" src="https://img.shields.io/badge/root-ephemeral-f48271?labelColor=0b0f17&style=flat-square">
<a href="LICENSING.md"><img alt="License: MIT for this fork's changes; inherited code unlicensed" src="https://img.shields.io/badge/license-MIT%20(fork%20changes%20only)-d4894a?labelColor=0b0f17&style=flat-square"></a>
</p>
<p align="center">
<b><a href="#-quick-start">Quick start</a></b> ·
<b><a href="#-what-this-fork-changes">What this fork changes</a></b> ·
<b><a href="#-how-it-works">How it works</a></b> ·
<b><a href="#-build-from-source">Build</a></b> ·
<b><a href="#-troubleshooting">Troubleshooting</a></b> ·
<b><a href="#-credits">Credits</a></b>
</p>
---
**GalaxyCrash** exploits [CVE-2026-43284](#the-vulnerability), a page-cache write in the Android
kernel's IPsec ESP path, to load a kernel module and start an SU daemon on a device whose bootloader
is still locked and whose kernel is still stock. Nothing is flashed. Nothing survives a reboot.
<p align="ce