GhostLock Root on Supported Google Pixel Builds with a Locked Bootloader
The Root My Pixel project provides build-specific payloads that use the GhostLock kernel exploit to obtain temporary root while the bootloader remains locked. This is a narrow, firmware-dependent security-research workflow. It is not a general rooting method for every Pixel, Android release, or carrier variant.
The upstream payload repository describes credential and SELinux patching followed by a late-loaded ReSukiSU/KernelSU module. Root access ends after reboot. A locked bootloader does not mean the running system remains trustworthy while the exploit is active, does not prove that hardware attestation or security-sensitive apps will behave normally, and does not guarantee protection from a crash or data loss. Back up the device before testing.
Primary project references: Root My Pixel and Root My Pixel payloads. Check those repositories immediately before use; payload support can change independently of this article.
Technical Anatomy of the GhostLock Exploit (CVE-2026-43499)
The GhostLock exploit targets a use-after-free (UAF) condition within the Linux kernel priority inheritance futex implementation (kernel/locking/rtmutex.c), specifically located within the remove_waiter() function call. This subsystem manages priority inversion handling between real-time and normal threads.
| Exploitation Stage | Subsystem Involved | Execution Mechanism | Security Boundary Traversed |
|---|---|---|---|
| 1. Futex Race Window | sys_futex system call | High-frequency multithreaded contention triggers a race between waiter removal and thread destruction | Unprivileged userspace to unmanaged kernel memory |
| 2. Dangling Pointer Reuse | Kernel SLUB Allocator | Heap spray reclaims the freed waiter struct with controlled metadata structures | Arbitrary kernel read/write primitive obtained |
| 3. Memory Module Injection | Dynamic Kernel Module Loader | Bypasses module signature verification in memory to inject kernelsu.ko | SELinux policy enforcement and kernel memory protection |
| 4. Superuser Hooking | Kernel VFS & Syscall Tables | KernelSU establishes hooks to manage UID 0 transitions for authorized processes | Grants root context without modifying physical boot images |
The elevated state is non-persistent and must be re-established after reboot. That fact alone does not prove that every failure leaves the device or user data unchanged.
Architectural Comparison: Traditional Bootloader Unlock vs. GhostLock
Understanding the operational differences between permanent bootloader unlocking and runtime kernel module injection clarifies the use cases and limitations of each approach:
| Architectural Vector | Traditional Fastboot Unlock (Magisk/KernelSU LKM) | Runtime Memory Injection (GhostLock) |
|---|---|---|
| Bootloader State | Unlocked (fastboot flashing unlock) | Remains locked on an upstream-supported build |
| Running-system trust | Modified boot chain is visible | Kernel security is actively bypassed during the rooted session |
| User Data Risk | Unlocking wipes user data | No unlock-triggered wipe, but crashes and exploit failures still require a backup |
| Carrier Policy Restrictions | OEM unlocking policy can block this route | Support depends on an exact upstream payload; carrier status alone proves nothing |
| Persistence Across Reboots | Permanent across soft and hard power cycles | Ephemeral (Privileges terminate upon reboot) |
| Attestation and sensitive apps | Commonly affected | Not guaranteed; test Wallet, RCS, banking and integrity-dependent apps separately |
Environment Prerequisites and Required Components
Before attempting execution, ensure the device meets the targeted software parameters:
- Exact payload match: Match both the Pixel codename and full build ID against a target in the upstream payload repository. A security-patch month, Android version, or model family is not precise enough. If the exact pair is absent, stop.
- Elevated Shell Bridge (Shizuku): Deploys Android’s native Wireless Debugging service to provide
shell(UID 2000) execution permissions required to interact with futex endpoints. - Exploit Wrapper (Root My Pixel): The orchestration tool containing the offset mapping and module payload.
- Superuser Manager (ReSukiSU): The userspace interface for controlling superuser privileges granted by KernelSU.
Step-by-Step Google Pixel GhostLock Root Execution
Follow these sequential steps to establish temporary root privileges on a locked Google Pixel handset.
1. Install Required APKs
Download and install the three primary application packages on your Google Pixel handset: Shizuku, Root My Pixel, and ReSukiSU. You can sideload the APKs manually via an on-device browser or push them from a workstation. Once installed, reboot the phone normally to ensure package manager caches are synchronized.
| Package Component | Version Target | Repository Link |
|---|---|---|
| Shizuku | v13.6.0 or later | Download Official APK |
| Root My Pixel | Use a release that explicitly lists your full build | Review upstream releases |
| ReSukiSU | Use the version required by that Root My Pixel release | Review upstream releases |
2. Pair and Start Shizuku
Launch Shizuku, tap Pair, and navigate to Settings > System > Developer Options > Wireless Debugging. Ensure your handset is connected to an active Wi-Fi network. Select Pair device with pairing code, note the pairing PIN, and enter it into the Shizuku notification prompt. After pairing succeeds, return to Shizuku and tap Start to initiate the background ADB daemon bridge.
3. Run GhostLock Exploit via Root My Pixel
Open Root My Pixel and compare the displayed device codename and full firmware build with the upstream payload target before granting Shizuku access. Tap Install ReSukiSU only after an exact match. An in-app success message is an execution result, not proof that the phone, attestation, radio, Wallet, or RCS state is unchanged.
4. Verify Root in ReSukiSU
Launch the ReSukiSU manager application. The primary dashboard should reflect that the KernelSU core module is active. Navigate to the Superuser tab to verify that root access rules are configured, permitting elevated shell permissions for terminal emulators and diagnostic tools.
5. Verify Root with GSM6 Pixel Tool Pro
Connect your Google Pixel to a diagnostic workstation via USB cable. Launch GSM6 Pixel Tool Pro, ensure ADB communication is active, and click Read Info. Inspect the generated diagnostic output. When root injection is successful, the utility displays Root State: Active.
Diagnostic Verification and CLI Inspection
Technicians can verify elevated shell execution directly from a connected workstation terminal:
adb shell "su -c 'id'"A properly injected environment will return the superuser context:
uid=0(root) gid=0(root) groups=0(root) context=u:r:su:s0If the command returns permission denied or fails to locate the su binary, the injection has lapsed or the Shizuku bridge was terminated prior to payload delivery.
Architectural Limitations and System Integrity Considerations
While runtime memory exploitation provides substantial utility for forensics and repair, technicians must respect several architectural constraints:
| Operational Consideration | Diagnostic Reality | Remediation Protocol |
|---|---|---|
| Non-Persistence | All kernel patches and modules are lost upon system reboot | Exploit execution must be repeated manually after each restart |
| Kernel Panics | Unaligned memory access during the race window can trigger an immediate reboot | Allow the handset to boot into stock Android and re-execute the injection sequence |
| Offset Dependency | Updates to newer Android security patch revisions alter kernel structure offsets | Check tool offset compatibility prior to updating system firmware |
| SELinux Contexts | Injected processes must operate within compatible domain boundaries | Ensure utilities request root authorization through the ReSukiSU interface |
| Wallet, RCS and integrity-dependent apps | A locked bootloader does not guarantee normal behavior during or after exploitation | Test each required app; do not use this workflow on a primary device that depends on them |
Technical and Regulatory Inquiries
Can I root my Google Pixel without unlocking the bootloader?
Only when Root My Pixel provides a payload for the exact device codename and full firmware build. The bootloader can remain locked, but this is still a kernel security bypass with device and data risk.
Is this locked-bootloader root method permanent?
No. The GhostLock exploit provides non-persistent, temporary root access. Because storage partitions remain untouched and cryptographically verified, elevated privileges terminate whenever the handset is rebooted. The exploit must be re-executed after each power cycle.
Which Google Pixel firmware builds support this exploit?
Support is defined by the exact targets in the upstream payload repository. Do not infer support from a patch month or Android version, and do not downgrade merely to reach a listed target.
Does this root method wipe user data or factory reset the device?
The workflow does not invoke the bootloader-unlock wipe, but that is not a zero-data-loss guarantee. Back up first because an exploit failure, kernel panic, or later recovery action can still cause loss.
Why is the Shizuku framework required for this process?
Shizuku leverages Android wireless debugging APIs to grant elevated shell permissions (UID 2000) to the Root My Pixel tool. This shell privilege level is necessary to interact with low-level kernel interfaces and trigger the race condition.
What role does ReSukiSU play in the exploitation chain?
ReSukiSU serves as the userspace manager for KernelSU. Once the exploit late-loads the kernel module, ReSukiSU handles root grant authorization, su daemon lifecycle, and access policies for calling applications.
Can Magisk be utilized instead of KernelSU with GhostLock?
No. Magisk operates by modifying the boot or init_boot partition ramdisk, which requires an unlocked bootloader to pass Android Verified Boot. GhostLock specifically relies on runtime kernel memory patching, which aligns with KernelSU architecture.
How does this method benefit carrier-locked Pixel devices?
Carrier policy does not establish payload compatibility. Proceed only if the exact device codename and full firmware build are listed upstream; otherwise the method is unsupported.
Is a desktop computer strictly required to complete the procedure?
No. The installation and exploitation pipeline can be performed directly on the handset using Shizuku wireless debugging pairing over local Wi-Fi. A workstation is only needed if utilizing GSM6 Pixel Tool Pro for external diagnostic verification.
Video Walkthrough
Observe the physical on-device setup, Shizuku pairing, and ReSukiSU activation demonstrated in the tutorial below: