# 👻 Root your Android WITHOUT unlocking the bootloader — gone on reboot

**URL:** <https://onehack.st/t/root-your-android-without-unlocking-the-bootloader-gone-on-reboot/327198>\
**Category:** Tutorials & Methods\
**Tags:** android, security, root\
**Created:** [November 12, 2026, 5:32pm UTC](https://onehack.st/t/root-your-android-without-unlocking-the-bootloader-gone-on-reboot/327198 "2026-11-12T17:32:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [November 12, 2026, 5:32pm UTC](https://onehack.st/t/root-your-android-without-unlocking-the-bootloader-gone-on-reboot/327198/1 "2026-11-12T17:32:11Z")

</div>

### 👻 Root your Android WITHOUT unlocking the bootloader — gone on reboot

ghost root: the bootloader stays LOCKED, root works for one boot session, a restart washes everything away — your warranty never notices

 ![root your android like a ghost](https://onehack.st/uploads/default/original/3X/7/2/725e228d2b19c932346d04f9299fc242bed7d16e.png)

no unlock · no flash · no traces · reboot = back to stock

a public kernel bug ([CVE-2026-43499](https://nvd.nist.gov/vuln/detail/cve-2026-43499)) gives admin power for one boot session, with KernelSU riding along — this is the [open-source project](https://github.com/woshimaniubi8/CVE-2026-43499-root-KernelSU) that packs it into one run (542​⭐, GPLv3)

```plaintext
  [LOCKED PHONE] ──▶ [KERNEL BUG] ──▶ [ROOT · TODAY]
   bootloader one public KernelSU loads
   stays locked CVE, run once gone on reboot

```

▁ ▂ ▃ what the ghost can do ▃ ▂ ▁

🧩 KernelSU modules — real root powers while the session lasts, no bootloader touched

🏦 banks see a stock phone — locked bootloader, reboot-clean… but that’s “usually”, not a promise: test your bank first

🛡 warranty stays intact — no unlock flag, no eFuse trip, nothing flashed, ever

▁ ▂ ▃ does your phone have a ghost? ▃ ▂ ▁

| phone | ghost status |
| --- | --- |
| 🥇 **POCO X7 Pro / Redmi Turbo 4** | ✅ the verified target ([repo](https://github.com/woshimaniubi8/CVE-2026-43499-root-KernelSU)) |
| 📱 **Xiaomi 17 / Pro / Ultra** | ✅ full Android 16 port ([popsicle](https://github.com/x-spy/CVE-2026-43499-popsicle)) |
| 💪 **Redmi K70E** | ✅ one-click flow ([duchamp-root](https://github.com/Colorful-glassblock/duchamp-root)) |
| 🤖 **Samsung · Pixel (GKI 6.12)** | 🔨 in progress ([S26](https://github.com/1ndevelopment/CVE-2026-43499-S26)) |
| 🤳 **Pixel 6 → 11** | 🔨 community profiles ([Root My Pixel](https://github.com/alex193a/Root-My-Pixel)) |

same model name is NOT enough — every port needs your exact firmware build, matched by hash

▁ ▂ ▃ the honest fine print ▃ ▂ ▁

🔁 reboot = clean — the ghost leaves, stock returns, unroot = reboot + delete payload + revoke ADB

🚪 the bug cuts both ways — until your kernel is patched, that same door exists for bad apps: use a spare phone, not your main one

⚖ banks: usually, not guaranteed — hardware checks on Android 13+ can still notice a modified session ([Play Integrity](https://developer.android.com/google/play/integrity/verdicts))

🧯 images come from official OEM packages only — Google’s [OTA sideload](https://developers.google.com/android/ota) needs no unlock; wrong-firmware experiments are how bricks happen

Root like a ghost: in, do the thing, reboot — and the phone never knew.