A community developer says a new Galaxy S22 Ultra root exploit works on one current Canadian firmware build by using CVE-2026-43499, a high-severity flaw in the Linux kernel. The demonstration is important, but it does not mean every Galaxy S22 can be rooted—or attacked remotely.
Patch status: CVE-2026-43499 is not listed in Samsung’s August 2026 security bulletin. Last checked: 10 August 2026.
What you need to know
- The new claim was posted on 9 August 2026 and targets the Canadian Galaxy S22 Ultra model SM-S908W.
- The tested phone reportedly runs Android 15, firmware S908WVLS8FYG7 and Linux kernel 5.10.226.
- CVE-2026-43499, commonly called GhostLock, is a real Linux kernel use-after-free flaw rated 7.8 High, but it is local: an attacker first needs a way to run code on the phone, and it is not a remote one-click attack by itself.
- Owners should install Samsung security updates, avoid untrusted APKs and check their exact model, build and security patch level.
What happened in the last 24 hours?
A developer using the name Technical-Difficulty38 published a Galaxy S22 Ultra proof-of-concept claim on Reddit on 9 August. The same report was cross-posted to r/S22Ultra and r/Magisk. The post says the port can gain elevated access on a specific SM-S908W build without the normal bootloader-unlock route.
The report quickly attracted attention because modern Samsung phones are difficult to root, especially North American models with tightly locked bootloaders. Root access gives the owner deep control, but the same level of access can be dangerous if obtained by a malicious app.
LinuxPanda has not independently run the code on a physical S22 Ultra. We are therefore treating the device result as a community demonstration, not as a confirmed Samsung-wide security advisory.
The exact Galaxy S22 Ultra configuration tested
| Data point | Reported target | Why it matters |
|---|---|---|
| Phone | Galaxy S22 Ultra SM-S908W | This is the Canadian Snapdragon model, not every S22 variant. |
| Android | Android 15 / SDK 35 | The result should not automatically be applied to Android 16 builds. |
| Firmware | S908WVLS8FYG7 | Exploit offsets can be specific to one firmware image. |
| Kernel | 5.10.226 Android common-kernel branch | The upstream fix arrived later in the Linux 5.10 stable line. |
| Architecture | 64-bit ARM | The proof of concept is built for this hardware and software combination. |
This narrow test matrix is the most important limit in the story. A base Galaxy S22, S22+, Exynos model, US carrier build or a phone with a different monthly patch may behave differently.
What CVE-2026-43499 actually is
NIST’s CVE record describes a use-after-free weakness, classified as CWE-416, in the Linux kernel’s real-time mutex code. The trigger path passes through futex_requeue(). In simple language, one kernel task can be handled as if it were another task during a particular locking operation. That can leave an invalid pointer behind and create an opportunity to interfere with kernel memory.
The flaw is widely referred to as GhostLock. The vulnerable behaviour dates to Linux 2.6.39, released in 2011, making this roughly a 15-year-old kernel defect rather than a newly introduced bug.
Kernel.org assigned the issue a CVSS 3.1 score of 7.8, or High. The complete vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It describes a local attack with low complexity, requiring low existing privileges but no user interaction. Successful exploitation can affect confidentiality, integrity and availability.
The upstream Linux project lists fixed stable versions including 5.10.261, 5.15.212, 6.1.175, 6.6.140, 6.12.86, 6.18.27 and 7.0.4. Linux 7.1 also contains the original fix. Those numbers are useful for normal Linux systems, but Android vendors often maintain their own kernels and backport individual patches. A Samsung phone can therefore contain the fix without showing one of those exact kernel versions.
Is this a remote attack on every Galaxy S22?
No evidence currently supports that conclusion. The official CVE classification is local. A malicious party would first need code execution on the device, such as through an installed hostile app or a separate vulnerability. The newly posted demonstration also depends on firmware-specific data and timing.
That does not make the flaw harmless. Android’s app sandbox is designed to stop ordinary apps from taking control of the whole operating system. A working local kernel exploit can become the second stage of an attack chain, turning limited app access into root-level control.
LinuxPanda analysis: why this story matters
This is a Linux-kernel CVE analysis using the S22 Ultra report as a device case study. It is not a rooting guide or a claim of independent Android exploit testing.
Three details make the report worth watching.
- The affected code is shared Linux infrastructure. Android uses the Linux kernel, so a locking bug discovered upstream can eventually matter to phones, tablets and other devices that carry older vendor kernels.
- The tested kernel is old but still realistic. Android devices commonly stay on long-lived kernel branches while vendors backport security fixes. The version label alone does not tell an owner whether a specific patch is present.
- Public proof-of-concept code changes the risk discussion. A CVE record explains the defect; a device-specific port suggests that the flaw may be practical on at least one real retail configuration. Independent confirmation and Samsung’s patch status are still needed.
The biggest unanswered question is not whether upstream Linux fixed the bug—it did. The question is which Samsung firmware trains received the backport and when. Until Samsung maps the CVE to a security maintenance release, users should avoid broad claims that every updated S22 remains vulnerable.
The S22 is also not the first Android device connected to GhostLock research. Public community projects and discussions have explored ports for newer Galaxy and OnePlus devices. Their existence shows growing research interest, but each result remains dependent on an exact kernel and firmware build; it does not prove universal support for the S24, S25, Z Fold 7 or any other model.
How Galaxy S22 owners can check their phone
- Open Settings → About phone and record the model number.
- Open Software information and note the build number, Android version and Android security patch level.
- Go to Settings → Software update → Download and install.
- Keep Google Play system updates current as well.
- Do not install APK files from links, chat messages or unknown download sites.
A different kernel number does not prove safety or vulnerability. The reliable answer must come from the vendor’s patch notes or a verified test on the exact build.
Should owners try the root method?
Most owners should not. The author warns that the timing-sensitive attempt can cause a kernel panic. Rooting can also weaken device security, interfere with banking or workplace apps, complicate updates and put personal data at risk.
Security researchers using a spare, backed-up device have a different risk calculation. For an everyday phone containing messages, payment accounts and authentication apps, waiting for verified patch information is the safer decision.
Frequently asked questions
Does CVE-2026-43499 affect all Android phones?
No. The Linux flaw covers affected kernel code, but real Android exposure depends on the device kernel, vendor backports, firmware and whether an attacker can run local code.
Can a website root a Galaxy S22 with this flaw?
The current evidence does not show that. CVE-2026-43499 is classified as a local vulnerability, not a stand-alone browser or remote attack.
Is the Galaxy S22 Ultra exploit confirmed by Samsung?
Not at the time of publication. The fresh device claim comes from a community developer, while the underlying Linux vulnerability and upstream fixes are documented officially.
Will a security update remove the risk?
A firmware containing the correct vendor backport should block this particular kernel path. Samsung’s release notes need to identify the fix, or the exact build must be independently tested.
What happens next
We will watch Samsung’s security maintenance releases, Android kernel patch activity and independent tests of other Galaxy S22 builds. This article will be updated when a vendor advisory or reproducible confirmation becomes available.
For more Linux release and security context, follow our Linux 7.2 release tracker and our explanation of why Linux 7.2 RC7 matters.
Comments