CVE watchlist (bootchain & kernel primitives)
Shared tracker. Applicability notes from hands-on testing where available.
| CVE / advisory | Component | What it is | Notes |
|---|---|---|---|
| CVE-2026-43499 | Linux kernel (rtmutex / futex PI requeue) | Waiter UAF → temp root | Our live primitive. Patched in the Oct 2026 SMR — never update past Sept 2026 on a research device. Device-specific ports exist (GhostLock family). |
| CVE-2026-24090 | Qualcomm ABL (EDK2) | Missing auth on partition-table processing → redirect boot flow / load unauthorized code | Affected list includes Snapdragon 8 Gen 3. OEMs notified 2026-03-02, public 2026-06-01. Patch state of Samsung Sept-2026 builds unknown — abl is encrypted at rest, static diff impossible. Behavioral test = high risk. |
| CVE-2026-24088 | Qualcomm ABL | "Unauthorized write access to load a customized bootloader" (CVSS 8.2) | Sibling of 24090, same bulletin — treat as coupled. |
| CVE-2026-24091 | Qualcomm bootloader fastboot | Command-parser overflow → bootloader code exec | Needs fastboot mode — Samsung exposes Odin/download instead. Low relevance. |
| CVE-2026-21385 | Qualcomm graphics | Integer overflow, exploited in the wild, CISA KEV (2026-03-03), 235 chipsets | Kernel-level primitive; patched in Sept 2026 builds. Evidence SM8650 is actively targeted. |
| KLCERT-25-012 | Qualcomm BootROM | Write-what-where, physical access → secure-boot bypass | Kaspersky ICS-CERT 2026-04-20. Chipset list unconfirmed — track it. BootROM bugs are firmware-unpatchable. |
| SM8850 UEFI/GBL chain (no CVE in this doc) | Qualcomm UEFI (8 Elite Gen 5) | Unsigned EFI payload via unauth'd GBL/efisp load path (Setup Mode / missing PK) → VBRwDeviceState(WRITE_CONFIG) → TZ flips RPMB unlock bits |
The playbook pattern. Full PoC published (tryigit.dev, Mar 2026). Same class of weakness (policy engine off) confirmed on SM8650 Samsung firmware — see the companion repo's docs/uefi-config.md. |
Rule of thumb
Qualcomm ships the same UEFI/ABL code across chip families. A bug pattern demonstrated on one Snapdragon generation is worth checking on the others — especially the authorization gaps around variable policy, partition tables, and privileged TZ protocols.