Use-after-free in the futex/rt_mutex proxy-lock path is a nasty one to land reliably since it needs winning a race on FUTEX_CMP_REQUEUE_PI - but once you've got the race, the chain going through pi_blocked_on to a dangling waiter and corrupting kernel structures for privilege escalation is a pretty clean local root primitive. Worth checking if your fleet's kernel version is actually in the affected range before assuming Play System Updates covers you - Pixel kernel patch cadence lags GKI sometimes. Full attack chain breakdown here: https://vuln.today/cve/CVE-2026-43499
I don't entirely know what it all means but that was hot. I am glad to hear I shouldnt assume safe. Gemini stanned google and said look at that security patch date also Linux and android kernel labels don't align. And I thought bull****.
I was afraid this wouldn't be up to par with the degree of conversation had on this sub. Having seen your response I'm in a foreign land. That said you were immensely informative and helpful.
1
u/Just_Worldliness_714 20h ago
Use-after-free in the futex/rt_mutex proxy-lock path is a nasty one to land reliably since it needs winning a race on FUTEX_CMP_REQUEUE_PI - but once you've got the race, the chain going through pi_blocked_on to a dangling waiter and corrupting kernel structures for privilege escalation is a pretty clean local root primitive. Worth checking if your fleet's kernel version is actually in the affected range before assuming Play System Updates covers you - Pixel kernel patch cadence lags GKI sometimes. Full attack chain breakdown here: https://vuln.today/cve/CVE-2026-43499