- Temporary Root gains a privileged session by exploiting a kernel vulnerability, loads a KernelSU-compatible module, and hands root to the manager you already use. Reboot and the device is back to stock.
- 💡 Why Temporary Root?
- ✨ Features
- 📥 Requirements & Installation
- 🔬 How It Works
- ❓ FAQ
- 💖 Support the Project
- 🙏 Credits
-
Most root methods ask you to unlock, patch and flash a boot image, which is permanent, device specific and easy to get wrong. Temporary Root does the opposite: it stays inside a running Android system, uses a kernel bug for a few seconds, and gives the result to a normal KernelSU manager.
-
It also solves the boring part — knowing whether your kernel is actually exploitable. The app runs a real probe instead of guessing from a version string, so "compatible" means tested, not assumed.
Three gates, and the last one is a live test.
How the check decides (Click to Expand)
- Kernel branch gate — DirtyFrag only has modules for the GKI branches it ships (5.10, 5.15, 6.1, 6.6, 6.12, 6.18). Non-GKI 4.x kernels are rejected with an explanation instead of a false positive.
- Module signing gate — if the kernel sets
CONFIG_MODULE_SIG_FORCE=y, the bundled unsigned modules cannot load, so the check stops there. - Live probe — writes 16 bytes into a private temp file's page cache through the real ESP/CBC
primitive and reads them back:
- pattern changed → Vulnerable
- unchanged → Not vulnerable (patched)
- probe could not run → Check inconclusive, never a false "compatible"
- The verdict drives the status dot and the Start button, so you cannot start an exploit the app already knows will fail.
CVE-2026-43284 — kernel page-cache write through in-place ESP decryption.
Supported kernels (Click to Expand)
- Android 12 → 5.10
- Android 13 → 5.10, 5.15
- Android 14 → 5.15, 6.1
- Android 15 → 6.6
- Android 16 → 6.12
- Android 17 → 6.18
The module is picked from your kernel branch and verified with the live probe above. On a kernel with the mitigation backported, the probe reports patched and Start stays disabled.
CVE-2026-43499 — futex PI use-after-free, driven by a per-kernel profile.
Why GhostLock needs a profile (Click to Expand)
- GhostLock needs exact offsets for your kernel build, so support is an exact
uname -rmatch, not a version range. - Nothing is bundled: the app downloads the matching upstream profile and its shared files, compiles them to the GLK1 format on the device, and starts the core with that profile.
- If upstream has no profile for your build, the check says so and tells you how many profiles exist.
- Profile generation for a new kernel is done with the upstream extractor from your
boot.imgor an OTA link; that is a separate workflow, not something the app fakes. - Already have a
.conffor this exact kernel? Settings → Import GhostLock profile validates thereleasefield againstuname -rand compiles it on the spot, so a broken profile is rejected before you ever tap Start. Upstream profiles still win when they exist; the import is the fallback for kernels upstream has never built.
The success estimate (Click to Expand)
The percentage shown after a check is a heuristic, not a measurement. It starts at 50% for an
upstream profile and 5% for an imported one (that file was not built by the project), then moves
with things the app can actually see: free RAM, thermal status, uptime, battery level, battery saver,
doze, whether the selected manager ships ksud, and whether the previous run finished. Night hours
add a little, since the phone is usually idle then. Every press also gets ±7% of run-to-run
variance, and the result is clamped to 5–95%.
Why these factors: kernel-race reliability degrades with competing load, thermal throttling and frequency scaling, and improves with a freshly rebooted, idle, cool device — see Playing for K(H)eaps (USENIX Security '22). The core already pins its threads and does the heap spray; the app can only control the environment around it.
Bring your own manager — the app only needs it to ship libksud.so.
Managers and Samsung handling (Click to Expand)
- Pick a manager in the app and tap Download — the APK is fetched from that project's GitHub releases, preferring a universal or arm64 build, and installed in place.
- OriginSU is the default.
- Also listed: KernelSU, KernelSU-Next, BakaSU, SukiSU-Ultra.
- On Samsung devices only the diabl0w KernelSU fork
is offered — Samsung kernels only accept its
ksud, so showing the others would just be a broken button. - Spoofed builds with random package ids are matched by app label, so they keep a working Download button instead of being treated as an unknown manager.
Mounts critical partitions as read-only to safeguard against bricking.
Protected partitions & safety (Click to Expand)
- Before handing root to your manager, the bootstrap marks critical system block devices — including
super,misc,steady, and slot partitions (*_a/*_b) — as read-only (BLKROSET). - This protects critical partitions from accidental writes, corrupted scripts, or rogue modules, ensuring your device cannot be bricked during a temporary root session.
- Applies automatically to both DirtyFrag and GhostLock exploit chains.
The few knobs that matter after root is up.
All the Settings (Click to Expand)
- Launch manager after success — open the selected manager once root is up.
- Start at boot — run the exploit on boot; the receiver is a normal app component, disable it any time.
- Auto soft reboot — off by default. Restarts Android services (not a full reboot) so the freshly loaded module binds; needed with KernelSU late-load. Applies to both exploits. While it is on, the manager launch below is skipped (the reboot replaces it).
- Disable KSU modules — writes a
disablefile into every/data/adb/modules/<id>, so modules stay off until you re-enable them in the manager. It is a blunt recovery switch, not a bootloop detector: it runs at root time. Applies to both exploits. - Import GhostLock profile — load a
.confgenerated for this exactuname -r; the file is compiled at import so a broken profile is rejected before a run. - About — version, community links, donation links and credits.
- DirtyFrag: GKI kernel — Android 12+ on 5.10, 5.15, 6.1, 6.6, 6.12 or 6.18. Non-GKI 4.x is not supported: those kernels have no Kernel Module Interface, so no shipped module can load.
- GhostLock: an exact
uname -rprofile published upstream. - A KernelSU-compatible manager that ships
libksud.so. - Android 12 or newer, arm64 device.
- Download the latest APK from the Releases Tab.
- Open the app and pick a root manager (Download installs it for you).
- Tap Check device compatibility and read the verdict.
- If it says Vulnerable / Supported, tap Start Temporary Root and wait for the manager to come up.
DirtyFrag chain (Click to Expand)
- IpSec transform — the app allocates a
UdpEncapsulationSocketand SPI and builds an AES-CBC/HMAC-SHA256 ESP transform throughIpSecManager. - splicehelper → crash_dump64 — the CBC primitive writes a helper into
crash_dump64's page cache.crash_dump64runs in thecrash_dumpdomain, which may openvendor_file-labelled files that an app cannot. - temproot.ko → vendor_file — the per-KMI module is written through that bridge.
- libc++ hook — shellcode patched into
libc++.soruns in init (uid 0, tid 1), creates/dev/tras a one-shot guard, and execsinsmodin thevendor_modprobedomain. - temproot.ko init — sets SELinux permissive, bypasses DEFEX where present, and runs the
bootstrap through
call_usermodehelper. - bootstrap — marks
super,misc,steadyand every*_a/*_bblock device read-only (BLKROSET), applies the module and soft-reboot settings, stagesksudfrom your manager's native libs and runsksud late-load, which brings up the manager you already have.
GhostLock chain (Click to Expand)
- The app resolves your kernel profile (HOCON) and compiles it into the GLK1 binary format.
libghostlock.soloads that profile and runs the futex PI race to hijack a victim thread.- It escalates to
init_cred, bypasses seccomp, and starts an independent root shell. - That shell runs our
bootstrap --protectwrapper for the manager'sksud: same block-device read-only protection, same module and soft-reboot settings as DirtyFrag. - It then runs the real
ksud late-loadfrom the manager you picked.
Log says patching failed and my device isn't vulnerable
Either your kernel is too new, your vendor backported the mitigation, or the probe hit the accidental mitigation seen on some 6.1 builds. The live probe is the authority here — no fix exists for a patched kernel.
Log says "Unsupported kernel"
Your kernel branch is not in the module list. Only the GKI branches above are built; vendor kernels
with a different vermagic cannot load these modules.
Root says SUCCESS or ksud errors, but I don't have root
Disable "Auto soft reboot" in Settings and run again. Some managers need the late-load to settle before the reboot.
I installed a module and now root crashes or bootloops
Enable "Disable KSU modules" in Settings. If you cannot boot, Android usually falls back to Safe Mode; from there disable "Start at boot" or uninstall the app.
GhostLock says unsupported for my kernel
Upstream publishes profiles only for kernels someone extracted offsets for. Your exact uname -r
is not in that list, and a nearby build string will not work — the offsets differ.
If you generated a .conf for this exact kernel with the upstream extractor, import it in
Settings → Import GhostLock profile. It is compiled and accepted on the spot, and the estimate
starts at 5% because the profile was not built by the project.
Is the GhostLock percentage real?
No, it is an estimate, and it only exists for GhostLock. Part of it is measured (RAM, thermals,
uptime, battery, battery saver, doze, missing ksud, unfinished run), part of it is ±7% deliberate
run-to-run variance, because two identical runs do not have identical odds. A high number means the
conditions are good, not that the race will land — a miss can still panic and reboot the phone.
Temporary Root is open-source and free. If it saved you a boot image patch, consider supporting the work:
- Sponsor via GitHub
- Donate via PayPal
- BHIM / international UPI:
shivamdhage@upi— QR code - GPay / UPI (India):
shivamashokdhage6@oksbi— QR code - Join Build Bytes on Telegram
- DirtyFrag research: v4bel
- DFRoot — the DirtyFrag chain, RO partition protection and late-load handoff this app is built on: diabl0w
- GhostLock research and profile format: YuKongA
- Unprivileged XFRM socket method: combeng6th/DirtyInit
- SELinux permissive modules and related code: polygraphene
lspromiseand various code: lsposed- Inter typeface (SIL Open Font License 1.1): rsms/inter
include.inccontains code Copyright © 2018 Odzhan, BSD-3-Clause