Use-After-Free Privilege Escalation in Android Kernel io_uring

This repository contains a local privilege escalation exploit targeting Android devices, specifically Google Pixel 6 and Samsung Galaxy S22, by abusing a vulnerability in the Linux kernel's io_uring subsystem. The main exploit logic is implemented in two C files: exp_pixel6.c and exp_s22.c, each tailored for the respective device. The exploit requires the attacker to extract the kernel symbol table from the device's boot image, using provided tools (unpack_bootimg.py and vmlinux-to-elf), and then run the compiled exploit binary on the device with the symbol file as an argument. If successful, the exploit grants a root shell. The repository also includes build scripts for Android NDK, and helper tools for kernel image and symbol extraction. The attack vector is local, requiring code execution on the device. No network endpoints are involved, but several fingerprintable file paths (such as /data/local/tmp and boot.img) are used in the exploitation process. The exploit is operational and provides a working root shell payload, but is not part of a larger exploitation framework.