Low Severity
CVE-2026-98260
Published: Nov 8, 2026
# CVE-2026-98260 vivo S60 (PD2571) PoC
POSIX CPU timer UAF → uid-0 shell + KernelSU late-load
For security research on devices you own or have authorized access to only. Exploit code intentionally does not implement persistence, does not write to partitions, and does not leave backdoors; use at your own risk.
## Background
Due to an update to Google's October security patch, it became impossible to use ghostlock for temporary root access.
## Target Device
| Item | Value |
| ------------------ | ------------------------------------------------ |
| Device | vivo PD2571 / V2571A (vivo S60) |
| Kernel | `6.1.145-android14-11-maybe-dirty` |
| System Version | `16.0.11.15.W10` |
| Google Security Patch | `2026-10-01` |
| CVE | CVE-2026-98260 |
| Source | Image, BTF, kallsyms and disassembly extracted from target `boot.img` |
## File Descriptions
| File | Purpose |
| ------------------------ | ----------------------------------------------- |
| `timer-t28-kernel15.c` | Exploit source code (PD2571-specific offsets) |
| `build-kernel15.bat` | NDK cross-compilation script |
| `启动KSU越狱-内核15.bat` | One-click push + execute + log collection |
| `run-kernel15.ps1` | PowerShell runner, executes exploit after device stabilizes |
| `t28-pd2463.c` | Reference: verified working version for PD2463 (iQOO Neo10 Pro+) |
| `derive_kernel15.py` | Derive kernel structure offsets from Image BTF |
| `Image` | PD2571 kernel image extracted from boot.img (contains BTF) |
| `patches/` | SukiSU-Ultra LKM fix patches (see below) |
## Current Status
### Verified ✅
Full exploit chain validated:
1. timer UAF primitive successful
2. fake cred written, uid/euid set to zero
3. SELinux global enforcing → permissive
4. full capability (`000001ffffffffff`)
5. seccomp = 0
6. `ksud late-load` rc=0, `kernelsu` LKM resident (`/proc/modules`)
7. ksud daemon completes ensure_binaries / restorecon / sepolicy / module scripts
8. All exploit artifacts reclaimed, no residue
```
[+] child report uid=0 euid=0 setuid(0)=0 errno=0 resuid=0/0/0
[ksu] late-load rc=0
KSU_LOADED
[+] success condition met: all exploit plants were reclaimed
[+] kernelsu module resident; procee
```