[Update] s22

[KeiraOMG0]

The newest update updates the kernel so do not update at all costs
will attempt to fix it to run on the newest kernel

[KeiraOMG0]

got root working now will need to work on the new driver

[sarabpal-dev]

Dont update this cve will get patched soon

[KeiraOMG0]

I'm gonna work on trying to build a ksu module + adaway block for updates

[KeiraOMG0]

i got a ko built but i cant get it to load, any idea?

[KeiraOMG0]

Update on KernelSU-Next (sarabpal-dev's / rifsxd's KernelSU-Next fork) for this device — S901USQSAGZH3, kernel 5.10.236.

What's built and working:

• Built the full GKI base kernel from Samsung's official opensource release for this exact build (matched vmlinux/Module.symvers), then built KernelSU-Next's kernel/ driver as an in-tree module (drivers/kernelsu) against it. kernelsu.ko loads cleanly via insmod with no crash (confirmed via lsmod, and its hooked symbols show up in /proc/kallsyms).
• Built the KernelSU-Next manager APK (com.rifsxd.ksunext) from source with the repo's default ksu.keystore, and confirmed via extract_apk_cert.py that its signing cert hash matches the driver's built-in EXPECTED_MANAGER_HASH/EXPECTED_MANAGER_SIZE defaults exactly — so manager and driver are already using the same key/cert, no mismatch there.

The actual blocker: Samsung's DEFEX "safeplace" check kills any root-privileged execve() of a binary whose path isn't in the compiled-in whitelist (defex_rules.c), independent of parent process identity — so ksud gets SIGKILLed the moment it's exec'd from /data/adb/ (or anywhere non-whitelisted) as root. Worked around this by bind-mounting ksud over a dormant whitelisted binary (/system/bin/resetreason) and exec'ing through that path — DEFEX sees the whitelisted path and lets it through, ksud's CLI runs fine that way (ksud --help, ksud debug info, etc. all work).

But even with ksud running and the module loaded, ksud debug info reports:

version: 0
flags: 0x0
uapi_version: 0
features: 0x0
lkm: false
late_load: false
runtime_mode: built-in
pr_build: false

Kernel Version: 0 — meaning ksud's supercall interface can't actually reach the loaded driver at all, even though lsmod confirms it's resident. The manager app also just shows "Not installed / Click to install" and offers only the boot-image-patch install flow, not LKM detection.

Also found and fixed two real build issues along the way (patches included in the attached zip):

• Kbuild's multi_depend macro in common/scripts/Makefile.lib strips subdirectory prefixes via $(notdir ...), breaking nested composite objects (kernelsu-objs += core/init.o etc.) on this kernel tree — patched to preserve the subdir path.
• ksu_reboot_guard_init() in reboot_guard.c wasn't marked __init despite only ever being called from kernelsu_init()'s own __init path — modpost flagged it as a section mismatch. Added the correct annotation.

Attached: zip of the kernel/ driver source tree as currently built (includes the two fixes above, plus a small kasan_memcpy_compat.c shim needed to satisfy __memcpy/__memset symbol resolution when KASAN_SANITIZE := n is set for the module — this kernel is CONFIG_LTO_CLANG_FULL=y + CONFIG_KASAN_HW_TAGS=y, and out-of-tree/KASAN-excluded objects were getting __memcpy/__memset compiler-lowered calls that aren't exported by this vmlinux).

Would appreciate any pointers on:

1. Whether the Kernel Version: 0 / lkm: false result is a known issue with LKM-mode driver builds not registering their supercall interface correctly, vs. something device/config-specific on our end.
2. Whether there's a cleaner way to handle Samsung DEFEX's safeplace restriction than the bind-mount trick (e.g. does upstream have any DEFEX-safeplace-specific handling beyond the KDP/RKP/DEFEX credential-sync compat code already in compat/samsung_defex.c?).

Happy to test further and report back.

[KeiraOMG0]

Driver source (with the fixes/shim mentioned above) is up here for reference: https://github.com/KeiraOMG0/KernelSU-Next-S901U-driver

[OnekkYt]

can i use this in kernel 5.10.237

[KeiraOMG0]

what device

[OnekkYt]

what device
(Its vurnable) but there is no payload for it

[KeiraOMG0]

is this s22?

[OnekkYt]

is this s22?

S908B s22 ultra

[KeiraOMG0]

check this guys repo it should be for this if not i can try porting it but i have no idea how to port the kernel driver

[farfromrefug]

@KeiraOMG0 i have the same device as you. To be clear did you manage to make it work? i am on kernel 5.10.0236-android12-9-31998796-abS901U1UESAGZH3

[OnekkYt]

@KeiraOMG0 i have the same device as you. To be clear did you manage to make it work? i am on kernel 5.10.0236-android12-9-31998796-abS901U1UESAGZH3

No i just tested with this app if im vulnerable
https://github.com/CakesTwix/Android-CVE-2026-43499

[farfromrefug]

@KeiraOMG0 i have the same device as you. To be clear did you manage to make it work? i am on kernel 5.10.0236-android12-9-31998796-abS901U1UESAGZH3

No i just tested with this app if im vulnerable https://github.com/CakesTwix/Android-CVE-2026-43499

what do you mean? your phone is a s22 ultra ? so not the same