[GitHub] CVE-2026-98260-vivo-s60-poc

Other

Type

N/A

CVSS Score

Views

Anonymous

Author

Description

# CVE-2026-98260 vivo S60 (PD2571) PoC

POSIX CPU timer UAF → uid-0 shell + KernelSU late-load

For security research on devices you own or have authorization to access only. Exploit code intentionally does not perform persistence, does not write to partitions, and leaves no backdoors; use at your own risk.

## Background

Updated to Google Security Patch October 2026, which made ghostlock temporary root unavailable.

## Target Device

| Item | Value |
| ----------------- | -------------------------------------------- |
| Device | vivo PD2571 / V2571A (vivo S60) |
| Kernel | `6.1.145-android14-11-maybe-dirty` |
| System Version | `16.0.11.15.W10` |
| Google Security Patch | `2026-10-01` |
| CVE | CVE-2026-98260 |
| Source | Image, BTF, kallsyms and disassembly from target `boot.img` |

## File Descriptions

| File | Purpose |
| ------------------------ | --------------------------------------------- |
| `timer-t28-kernel15.c` | exploit source code (PD2571-specific offsets) |
| `build-kernel15.bat` | NDK cross-compilation script |
| `启动KSU越狱-内核15.bat` | One-click push + execute + log collection |
| `run-kernel15.ps1` | PowerShell runner, executes exploit after device stabilizes |
| `t28-pd2463.c` | Reference: verified working version for PD2463 (iQOO Neo10 Pro+) |
| `derive_kernel15.py` | Derive kernel structure offsets from Image BTF |
| `Image` | PD2571 kernel image extracted from boot.img (includes BTF) |
| `patches/` | SukiSU-Ultra LKM fix patches (see below) |

## Current Status

### Verified ✅

All exploit chains passed:

1. timer UAF primitive hit
2. fake cred written, uid/euid zeroed
3. SELinux global enforcing → Permissive
4. full capability (`000001ffffffffff`)
5. seccomp = 0
6. `ksud late-load` rc=0, `kernelsu` LKM resident (`/proc/modules`)
7. ksud daemon completed ensure_binaries / restorecon / sepolicy / module scripts
8. All plants reclaimed, no remnants

```
[+] child report uid=0 euid=0 setuid(0)=0 errno=0 resuid=0/0/0
[ksu] late-load rc=0
KSU_LOADED
[+] success condition met: all exploit plants were reclaimed
[+] kernelsu module resident; procee
```

Translated to English from Chinese. Show original · see the source links.

Original (Chinese):

CVE 2026 98260 vivo s60 poc

# CVE-2026-98260 vivo S60 (PD2571) PoC

POSIX CPU timer UAF → uid-0 shell + KernelSU late-load

仅用于对自己拥有或已获授权的设备进行安全研究。利用代码刻意不做持久化、不写分区、不留下后门；使用风险自负。

## 背景

因为更新了谷歌安全更新10月补丁，导致无法使用 ghostlock 临时root

## 目标设备

| 项目 | 值 |
| ------------ | ---------------------------------------------------- |
| 设备 | vivo PD2571 / V2571A (vivo S60) |
| 内核 | `6.1.145-android14-11-maybe-dirty` |
| 系统版本 | `16.0.11.15.W10` |
| 谷歌安全补丁 | `2026-10-01` |
| CVE | CVE-2026-98260 |
| 来源 | 目标 `boot.img` 提取的 Image、BTF、kallsyms 与反汇编 |

## 文件说明

| 文件 | 用途 |
| ------------------------ | ----------------------------------------------- |
| `timer-t28-kernel15.c` | exploit 源码（PD2571 专用偏移） |
| `build-kernel15.bat` | NDK 交叉编译脚本 |
| `启动KSU越狱-内核15.bat` | 一键推送 + 执行 + 日志采集 |
| `run-kernel15.ps1` | PowerShell runner，等设备稳定后执行 exploit |
| `t28-pd2463.c` | 参考：PD2463 (iQOO Neo10 Pro+) 已验证通过的版本 |
| `derive_kernel15.py` | 从 Image BTF 推导内核结构偏移 |
| `Image` | PD2571 boot.img 提取的内核镜像（含 BTF） |
| `patches/` | SukiSU-Ultra LKM 修复补丁（见下文） |

## 当前状态

### 已验证 ✅

exploit 链全部通过：

1. timer UAF 原语命中
2. fake cred 写入，uid/euid 归零
3. SELinux 全局 enforcing → Permissive
4. full capability (`000001ffffffffff`)
5. seccomp = 0
6. `ksud late-load` rc=0，`kernelsu` LKM 常驻 (`/proc/modules`)
7. ksud daemon 完成 ensure_binaries / restorecon / sepolicy / module scripts
8. 所有 plant 回收，无残留

```
[+] child report uid=0 euid=0 setuid(0)=0 errno=0 resuid=0/0/0
[ksu] late-load rc=0
KSU_LOADED
[+] success condition met: all exploit plants were reclaimed
[+] kernelsu module resident; procee

References

https://github.com/molanp/CVE-2026-98260-vivo-s60-poc

[GitHub] CVE-2026-98260-vivo-s60-poc

Description

References

Community Rating

Quick Actions

Related Exploits