Critical Severity
Published: Nov 1, 2026
# matisse-public — Redmi K50 Pro (MT6983) / kernel 5.10.209 privilege escalation and KernelSU loading record
> **English TL;DR** — A fully documented, from-scratch writeup + toolkit for obtaining `uid=0` with a
> kernel SID on a **Redmi K50 Pro (matisse, MediaTek MT6983, kernel 5.10.209)** and loading **KernelSU via
> LKM late-load**, without unlocking the bootloader. Full source is published on purpose: a root tool you
> cannot audit is a root tool you should not trust.
---
## Why we publish the source code completely
This repository does **privilege escalation**. Any closed-source tool that "gives you root" should be
suspected: it can equally well do other things in secret, and you cannot verify it. Therefore we
**proactively publish all source code, log formats, failure processes and reproduction steps**, including:
- Complete exploit source code (`payload_src/`) — you can read line-by-line, compile yourself, verify hashes
- All scripts and criteria (`tools/`, `ksu_persist.sh`) — including **the failed attempts**
- Real kernel panic excerpts (`evidence/`) — proof of crashes we encountered and their root causes
- Build recipes and artifact hashes (`payload_src/mt87_build/BUILD_INFO.txt`, `SHA256SUMS`) — for your verification
- Clear **scope boundaries and liability disclaimers** (see below)
**Does not contain**: any device identifiers (serial numbers / MACs), personal data. Sources and licenses of third-party derived code are **listed item-by-item in [`NOTICE.md`](NOTICE.md) and [`payload_src/PROVENANCE.md`](payload_src/PROVENANCE.md)**.
---
## Results (verifiable)
| Item | Tested evidence |
|---|---|
| `uid=0` | `su -c id` → `uid=0(root) gid=0(root) groups=0(root)` |
| **kernel SID** | Same line: `context=u:r:ksu:s0` |
| **KernelSU loaded** | `/proc/modules` → `kernelsu … - Live` |
| Loader log | `/data/local/tmp/ksu_go.log` → `uid=0` / `load_policy rc=0` / `late-load rc=0` / `modules: 1` |
| Device not crashed | Same `boot_id` throughout, `uptime` increases continuously |
Complete report: [WIN_20261003_1620_uid0_kernelsu.md](WIN_20261003_1620_uid0_kernelsu.md)
> **Verification**: Hashes of published artifacts in this repository are in [`SHA256SUMS`](SHA256SUMS); build recipes and expected sha256 for exploit artifacts are in
> [`payload_src/mt87_build/BUILD_INFO.txt`](payload_src/mt87_build/BUILD_INFO.txt). If you do not trust any binaries, compile only from source yourself.
---
## What it does (high level)
1. **R round**: Heap layout on `pselect`'s `fd_set`, combined with dangling `pi_blocked_on` after `rt_waiter` release
triggers `rt_mutex_adjust_prio_chain` chain walk, landing on controlled write (write `task->real_cred`).
2. **E5 round**: Zero out SELinux's enforcing field (Per-Android's `enforcing-8` write), enter Permissive mode.
3. **C round**: Write `task->cred` (true uid=0 + kernel SID).
4. **gate branch** (this repository's key patch): At the moment of **truly obtaining uid=0**,
`system("sh /data/local/tmp/ksu_go.sh &")` — using official userspace loader `k