Low Severity
CVE-2026-98260
Published: Oct 29, 2026
Android front end for CVE-2026-98260: root shell + KernelSU late-load through Shizuku
# TimerRoot
Android front end for **CVE-2026-98260** (POSIX CPU timer use-after-free), the
same class of bug as CVE-2026-64560. One tap gives you a root shell and then
late-loads **KernelSU** (`u:r:ksu:s0`).
The exploit itself is *not* included here. This repository is the app shell
around it: UI, state detection and the Shizuku plumbing needed to run a
shell-domain exploit from an ordinary app.
## Why the app needs Shizuku
An app runs as `untrusted_app` and cannot read `/sys/kernel/tracing`, which the
exploit needs for its leak and trigger. TimerRoot therefore starts a **Shizuku
user service**, which Shizuku runs as the shell user (`uid 2000`,
`u:r:shell:s0`). The exploit binary executes inside that process, so it gets
the same environment it would have from `adb shell`.
```
MainActivity (untrusted_app)
└─ Shizuku user service (uid 2000, u:r:shell:s0)
├─ extracts assets/timer to /data/local/tmp/timer
└─ runs it; on success keeps /system/bin/sh alive
```
## Requirements
- Android 12+ (`minSdk 30`), arm64
- [Shizuku](https://shizuku.rikka.app/) running (start it from the Shizuku app
via wireless debugging, or over ADB)
- [KernelSU](https://github.com/tiann/KernelSU) manager installed, for the
`Load KernelSU` path
- A kernel build the exploit was ported to. The upstream binary targets
`6.12.69-android16-6-g242e1a07f878-ab15865446-4k`; see below.
## Getting the exploit binary
TimerRoot expects the compiled exploit at `app/src/main/assets/timer`:
```bash
git clone https://github.com/YuKongA/CVE-2026-98260
cp CVE-2026-98260/timer/timer app/src/main/assets/timer
```
or
```powershell
scripts/fetch-timer.ps1
```
The binary is MIT licensed by its authors; only use it on hardware you own, and
only when your kernel matches the build it was ported to.
## Build
### Android Studio / Gradle
Open the project and build, or:
```bash
./gradlew assembleDebug
```
The project needs the Android SDK with platform 36 and build-tools 36. The
Shizuku AP