DFRoot [DirtyFrag (CVE-2026-43284)]

DFRoot is an Android rooting tool that exploits CVE-2026-43284 (DirtyFrag) — a kernel page cache write primitive — to load a custom kernel module without requiring an unlocked bootloader. It is intentionally designed to be SU Manager agnostic and works with any KernelSU-compatible SU manager.

[!IMPORTANT] Before hitting that fork button, consider making a pull request instead :)

FAQ

Q: Log says patching failed and that my device isn't vulnerable

A: Sorry, there is no fix. Either:

• Your device's kernel is too new
• Your device manufacturer backported the official mitigation
• Accidental mitigation (typically seen on kernel 6.1)

Q: Log says "SUCCESS" or "ksud exited with error", but I don't have root

A: First, try disabling "Auto Soft Reboot" in DFRoot settings if you have it enabled, otherwise https://github.com/diabl0w/DFRoot/discussions/69

Q: I installed a module and now I can't launch root without crashing

A: Toggle "Disable KSU Modules" in DFRoot settings

Q: I installed a module and have "Start at Boot" enabled and now I am bootlooping

A: Typically Android will detect bootloops and boot you into Safe Mode, otherwise you can usually hold the Volume Down button during boot to enter safe mode. From there, disable "Start on Boot" and enable "Disable KSU Modules" in DFRoot settings or just uninstall DFRoot until you stabilize.

Usage

[!WARNING] I am not responsible for any damage to your device.

1. Install DFRoot
2. Install a SU Manager from below:
   • Samsung:
     • diabl0w's KernelSU
   • Other:
     • KernelSU
     • KernelSU-Next
     • KowSU

If you have a custom KernelSU fork for a specific manufacturer, please make a pull request to add it here.

Features

• Start on Boot
• Automatic soft reboot (if late-load --soft-reboot supported by your SU Manager)
• RO Partition Protection
• Disable all KernelSU modules, to recover from a broken one
• Shizuku not needed — regain root without WiFi!

How it works

The Android kernel decrypts AES-CBC ESP packets directly into the page cache of files open for splice(). By crafting IV = AES_ECB_DEC(key, current_content) ⊕ desired_content, any 16-byte-aligned block in a mapped shared library can be overwritten without write permission and without copy-on-write.

The exploit uses this primitive to patch shellcode into libc++.so in the kernel's page cache. The next privileged call to the hooked function runs the shellcode, which loads our custom kernel module via insmod.

Exploit chain

1. IpSec transform — App allocates a UdpEncapsulationSocket + SPI and builds an AES-CBC/HMAC-SHA256 ESP transform via IpSecManager.

2. splicehelper → crash_dump64 — The splicehelper binary is spliced into crash_dump64 via the CBC primitive. crash_dump64 runs in the crash_dump SELinux domain (via exec label transition), which can open vendor_file labeled files (untrusted_app context cannot read these files so we need this bridge). The splicehelper serves two modes: splice mode (pipe a 16-byte page chunk out to the parent for write) and read mode (argv[3]="r", write 16 bytes of file content to a pipe fd for IV computation).

3. dfroot.ko → vendor_file — The kernel module is written via the crash_dump bridge (splicehelper splice mode) into a vendor_file-labeled file.

4. libc++ hook (fires in init, uid=0, tid=1) — Shellcode is patched into libc++.so at std::ostream::sentry::sentry() (_ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryC1ERS3_). Triggered by: createOrphanProcess() double-forks so the grandchild is adopted by PID 1 (init); when init reaps the orphan its main thread (tid=1) calls through the hooked function. The shellcode:

   • Checks getuid()==0 and gettid()==1; returns immediately otherwise
   • Creates /dev/df as a one-shot mutex (O_CREAT|O_EXCL) to prevent re-entry
   • Clones a worker child (parent returns to init immediately)
   • Worker forks a grandchild; grandchild writes u:r:vendor_modprobe:s0 to /proc/self/attr/exec then execs /vendor/bin/insmod <ko_target>

5. dfroot.ko init (runs as vendor_modprobe, uid=0) — The KO is loaded by insmod in the vendor_modprobe SELinux domain:

   • Writes false to selinux_state (global permissive)
   • Bypasses DEFEX via kprobes (if applicable)
   • Calls call_usermodehelper to run our custom bootstrap code

6. bootstrap.c — performs various functions and finally launches the su daemon from your installed SU Manager.

Building

make

Credits

• Original PoC and various code: https://github.com/lsposed/lspromise
• SELinux Permissive kernel modules and various code: https://github.com/polygraphene/DFReroot
• Unprivileged XFRM socket method: https://github.com/combeng6th/DirtyInit