Missing authentication (CWE-306) in the Application Bootloader's partition-table
processing → local attacker redirects the boot flow → loads unauthorized code.
Qualcomm June 2026 bulletin. CVSS 7.1 (AV:L/AC:L/PR:L/UI:N). Reported 2025-12-15
(researcher "VoidTato"). OEMs notified 2026-03-02; NVD published 2026-06-01.
Affected list explicitly includes "Snapdragon 8 Gen 3 Mobile Platform" (SM8650).
Patch state of our September-2026 build: unknown (abl is encrypted at rest —
static diff impossible; behavioral test is high-risk).
CVE-2026-24088 — "load a customized bootloader"
Status: potential lead (sibling of 24090).
"Cryptographic Issue while processing a specific partition which allows unauthorized
write access to load a customized bootloader." CVSS 8.2, CWE-306. Reported
2026-01-18. Same bulletin, same root-cause family — treat as coupled patch.
CVE-2026-24091 — fastboot command parser overflow
Bootloader-mode memory corruption → code exec at bootloader level.
Requires fastboot mode with an accessible bootloader interface — Samsung exposes
Odin/download mode instead of fastboot. Low relevance for this device.
Chipset list not yet confirmed. BootROM bugs are unpatchable by firmware — if SM8650
is in scope this is the crown-jewel lead.
CVE-2026-43499 — GhostLock (rtmutex waiter UAF)
Status: our temp-root primitive. ACTIVE on this device — do not patch.
Kernel rtmutex use-after-free in the FUTEX_CMP_REQUEUE_PI rollback path; pselect6
spray for stack grooming. Device-specific ports exist (see references).
Patched in the October 2026 SMR. The device must never install it (OTA agents
disabled).
Key references
ZeroPath — "CVE-2026-24090: Brief Summary of a Boot Flow Cryptographic Bypass
Affecting Dozens of Snapdragon Chipsets"
(zeropath.com/blog/cve-2026-24090-qualcomm-boot-flow-cryptographic-bypass)
tryigit.dev — "Qualcomm Bootchain Zero-Day: Exploiting UEFI and GBL" (March 2026,
updated Aug 2026): the SM8850 three-stage chain, full VbRwStateApp.efi PoC source,
Verified Boot protocol GUID {98f41539-b818-47e8-9003-ffc19d330d14}, methodology
("map who is already authorized to use the protected resource").
(tryigit.dev/qualcomm-uefi-gbl-bootchain-zero-day-exploit/)
Qualcomm security bulletins (docs.qualcomm.com) — June 2026 (24088/24090),
March 2026 (21385).
Qualcomm QPSS22 "Breaking Mobile Bootloaders" (Christopher Wade) — ABL fastboot
TOCTOU + unlock-path patching methodology on SDM660; the historical template for
bootloader RE.
bootloader-unlock-wall-of-shame (github.com/zenfyrdev) — Samsung: no fix as of
Dec 2025; April 2026 update also blocks downgrades on some models.
Kitploit S26 GhostLock guide — "a second exploit run in the same boot can crash the
device — reboot before retrying" (matches our one-shot-per-boot recipe).
RootMyVivo fork — safety_quiesce (wait for loadavg < threshold before the PI route;
we found the inverse: too-quiet systems miss the race on our kernel).
Methodology notes (our tooling)
Android 16 system jars: dex version 041 → jadx 1.5.6 + JDK 17 (baksmali 2.5.2 —
the newest on Maven — cannot open dex 041).
Boot-chain static triage: lz4-decompress each BL member → per-PT_LOAD entropy +
printable-string keyword scan → classify encrypted vs plaintext (see tools/).
Stripped AArch64 binaries: capstone-based linear disasm + ADRP/ADD and ADRP/LDR
(literal-pool) xref scanners to map string references into functions.