CVE-2026-43499 Detector

Android app that detects the kernel vulnerability CVE-2026-43499 — a use-after-free in rtmutex triggered via futex_requeue.

Vulnerability

CVE	CVE-2026-43499
Type	Use-after-free
Component	kernel/locking/rtmutex.c
Trigger	futex_requeue → proxy-lock rollback in remove_waiter() uses current instead of waiter->task
CVSS	7.8 (HIGH)
Affected	Linux 2.6.39 – 6.1.174
Patched	6.18.27+, 6.12.86+, 6.6.140+, 6.1.175+

How it works

1. Checks kernel version against known-patched releases. If the kernel is at or above a patched version, reports safe immediately.
2. Otherwise, runs a native PoC binary (shipped via jniLibs, executed from nativeLibraryDir).
3. For 5 attempts:
   • Starts the binary
   • Waits 5 seconds
   • Sends SIGTERM
   • Waits 5 seconds for the process to die
4. If the process survives SIGTERM in any attempt (stuck in D-state) → vulnerable.
5. If all 5 attempts are killable → patched.
6. Waits an additional 5 seconds after the last attempt.

Binary bitness is auto-detected from Build.SUPPORTED_ABIS.

Requirements

• Android 7.0+ (API 24)
• ARM (32-bit build: armeabi-v7a)

Tech stack

• Kotlin
• Jetpack Compose
• Material Deisgn 3
• Single-activity architecture

Build

./gradlew assembleDebug

APK output: app/build/outputs/apk/debug/app-debug.apk

Links

• CVE-2026-43499 (NVD)
• PoC source code

Kernel patches

Kernel	Repository
3.4	acroreiser/android_kernel_lge_hammerhead
3.10	acroreiser/android_kernel_lenovo_a6010
4.4	acroreiser/android_kernel_samsung_universal8895
4.9	Lenovo-Z5s/android_kernel_lenovo_sdm710
4.4 ~ 5.10	oracle/linux-uek/uek6
5.15	oracle/linux-uek/uek7

Warning

Running the test on a vulnerable device may cause a kernel crash or spontaneous reboot. Proceed at your own risk.