Low Severity
CVE-2026-98260
Published: Oct 31, 2026
Temporary root for the Vivo iQOO 13 via CVE-2026-98260 posix-cpu-timer UAF, with KernelSU and FinaSU late-load
# CVE-2026-98260-IQOO-13
Temporary root for the Vivo iQOO 13 (Android 16, kernel `6.6.127-android15-8-ga8e7fdfdc746-ab16003472-4k`) using the CVE-2026-98260 POSIX CPU timer use-after-free, with optional KernelSU or FinaSU late-load.
Root is **temporary**: it lives until the next reboot, and nothing survives one.
## What's inside
```
poc/ the exploit: timer (posix-timer UAF, rb_erase zero-write primitive),
socket su daemon, and porting diagnostics
TempShell/ the Android app that drives the exploit (Shizuku user service):
payload management, one-tap root, KSU / FinaSU loading,
session logs and a root terminal
```
## How it works
1. **TempShell** (via Shizuku, running as `u:r:shell:s0` uid 2000) extracts and
SHA-256-verifies the bundled payloads to `/data/local/tmp/tempshell`.
2. `timer fake` sprays the target slab, triggers the UAF, and uses the
rb_erase 8-byte zero-write primitive to forge full-capability credentials.
The child lands a socket `su` daemon under a fresh tmpfs at
`/apex/com.android.virt/bin/su`.
3. From the verified root, the app can late-load a KernelSU kernel:
- **Load KSU** — the vanilla `ksud late-load`
- **Load FinaSU** — the bundled `finasu_ksud late-load` (FinaSU kernel +
manager support)
On-device flow: **Connect Shizuku → Start root session → Load KSU / Load FinaSU**.
## Building
### Exploit
NDK 28.2, aarch64, API 35 — see `poc/README.md` for the exact flags. The
hardcoded kernel offsets target the build named above; porting to another
kernel means re-deriving them from boot.img / BTF / kallsyms (see
`poc/tools/`).
### App
SDK-only build (no Gradle):
```sh
python TempShell/scripts/build.py
```
Requires: Android SDK (`--sdk`), the Shizuku API sources at `../Shizuku-API`
(`--shizuku`, cloned from `RikkaApps/Shizuku-API`; vendored but not committed),
and the payloads listed in `TempShell/app/src/main/assets/payloads.properties`
(SHA-256 verified both before