Low Severity
CVE-2026-98260
Published: Nov 5, 2026
CVE-2026-98260 vivo S60 PoC
# CVE-2026-98260 vivo S60 (PD2571) PoC
POSIX CPU timer UAF → uid-0 shell + KernelSU late-load
For security research on devices you own or have authorization to test only. Exploit code intentionally does not persist, write to partitions, or leave backdoors; use at your own risk.
## Background
After updating to Google security October patches, cannot use ghostlock for temporary root.
## Target Device
| Item | Value |
|------|-----|
| Device | vivo PD2571 / V2571A (vivo S60) |
| Kernel | `6.1.145-android14-11-maybe-dirty` |
| System Version | `16.0.11.15.W10` |
| CVE | CVE-2026-98260 |
| Source | Image, BTF, kallsyms and disassembly extracted from target `boot.img` |
## File Description
| File | Purpose |
|------|------|
| `timer-t28-kernel15.c` | exploit source code (PD2571-specific offsets) |
| `build-kernel15.bat` | NDK cross-compilation script |
| `启动KSU越狱-内核15.bat` | One-click push + execute + log collection |
| `run-kernel15.ps1` | PowerShell runner, executes exploit after device stabilizes |
| `t28-pd2463.c` | Reference: verified working version for PD2463 (iQOO Neo10 Pro+) |
| `derive_kernel15.py` | Derive kernel structure offsets from Image BTF |
| `Image` | Kernel image extracted from PD2571 boot.img (includes BTF) |
| `patches/` | SukiSU-Ultra LKM fix patches (see below) |
## Current Status
### Verified ✅
Entire exploit chain successful:
1. timer UAF primitive hit
2. fake cred written, uid/euid zeroed
3. SELinux global enforcing → Permissive
4. full capability (`000001ffffffffff`)
5. seccomp = 0
6. `ksud late-load` rc=0, `kernelsu` LKM resident (`/proc/modules`)
7. ksud daemon completed ensure_binaries / restorecon / sepolicy / module scripts
8. all plants reclaimed, no residue
```
[+] child report uid=0 euid=0 setuid(0)=0 errno=0 resuid=0/0/0
[ksu] late-load rc=0
KSU_LOADED
[+] success condition met: all exploit plants were reclaimed
[+] kernelsu module resident; proceeding to manager
```
### Not Closed Loop ❌ — manager cannot obtain driver fd
KernelSU / SukiSU manager startup reports:
```
ksud::ksucalls: KernelSU driver install syscall was blocked by seccomp
ksud::cli: Error: could not retrieve kernelsu driver fd
```
## Root Cause Analysis (BTF Confirmed)
KSU / SukiSU LKM manually wrote `seccomp_filter` structure in `kernel/infra/seccomp_cache.c`.
Compile-time structure layout **does not match** actual PD2571 kernel layout:
```
PD2571 actual (BTF type 21311, seccomp_filter):
+0x000 refs 32 bytes (refcount_t, KASAN padding)
+0x020 users 32 bytes
+0x040 log
+0x048 wait_killable_recv
+0x080 cache ← action_cache (128 bytes, includes allow_compat)
+
```