CVE-2026-24088 / 24090 patch state on q6q DZI1 — verdict

Checked 2026-10-23/24 against our own abl.elf (2,441,528 B, pulled live from the device, DZI1). 2026-10-24 correction: the abl is LZMA-compressed, not AES-encrypted — we decompressed it and extracted the 5 ABL apps (LinuxLoader/Odin/Cryptest/QuestSOD/QuestUSB). The whole bootloader is now RE-able offline, so this verdict is grounded in actual decompiles, not entropy guesses.

CVE-2026-24088 (GBL custom-bootloader load) — NOT APPLICABLE, structurally

The attack surface requires the Generic Boot Loader (GBL) architecture: an efisp partition, a fastboot handler, and the gpu-preemption boot-parameter injection path. Byte-level scan of our abl:

The surface simply does not exist in Samsung's q6q ABL. The public PoCs (kasnria001, the POCO M7 chain from 2026-09-29) target Xiaomi GBL devices — different boot architecture entirely. Also fixed at SPL 2026-09-05 anyway (our patch level), so it is double-closed.

CVE-2026-24090 (ABL partition-table missing auth) — no surface, needs a write primitive first

• CPE lists SM8650Q; the bug = the ABL does not authenticate the GPT/partition table before acting on it.
• Our abl shows no gpt_partition / validate_gpt / partition-table-validation strings — Samsung's ABL handles partitioning differently (no such code path to lean on).
• No public PoC exists. The vulnerability is a post-root persistence primitive (you already need a write primitive to modify the GPT) — not an unlock entry point on its own.
• The behavioral test (GPT redirect) is HIGH RISK on a fused device and was NOT run. Ruled out on static evidence.

Bottom line

Both June-2026 Qualcomm CVEs are closed on this device: 24088 structurally (no GBL), 24090 practically (no PoC, needs a primitive we don't have). The remaining unlock lanes: the TZ-side ICCC/VaultKeeper state (from root) and the EDL/firehose route. See the bootloader-lanes research in the bank.