Threat reportVulnerabilityTL-2026-3393
Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock (CVE-2026-43499 Ghostlock)
Amazon Fire TV Cube 3 Exploit Enables Root Access and (TL-2026-3393), also tracked as Ghostlock, is a medium-severity software vulnerability scored CVSS 7.8, first published 2026-10-13. It has no confirmed attribution, affects Amazon Fire TV Cube (3rd generation, 'gazelle', AFTGAZL), references 3 CVEs (CVE-2026-43499, CVE-2022-38181, CVE-2022-46395), maps to 7 MITRE ATT&CK techniques (T1059.004, T1068, T1105), and is covered by 9 detection rules and 25 indicators of compromise.
- CVSS
- 7.8/10Medium
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-3393
- Threat ID
- TL-2026-3393
- Also known as
- Ghostlock, Fire TV Cube 3 gazelle unlock
- Severity
- MEDIUM
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- consumer, hospitality, media-entertainment
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
- Updates
- 2026-10-13 · revalidated 1× · latest source
Malware and tooling in Amazon Fire TV Cube 3 Exploit Enables Root Access and
Malware and tooling: root, Fire TV Cube 3 gazelle unlock package v1.2, Ghostlock exploit port (mforce2)
How Amazon Fire TV Cube 3 Exploit Enables Root Access and works
A public exploit package by XDA developer Pro-me3us gives temporary root and a bootloader unlock on the 3rd-generation Amazon Fire TV Cube ('gazelle', firmware PS7717 or older), using a port of the Linux kernel rtmutex use-after-free GhostLock (CVE-2026-43499) plus a bootloader flaw. It requires local ADB access, is not presented as a remote attack, and no malicious exploitation in the wild is reported.
On 2026-10-13 Cyber Security News reported a public exploit package, released by XDA developer Pro-me3us, that unlocks the bootloader and provides root on the 3rd-generation Amazon Fire TV Cube (model 'gazelle', build model AFTGAZL) running firmware PS7717 or older. The latest package version cited is 1.2, released 2026-09-30. The work credits several contributors: Pro-me3us (project lead and integration), mforce2 (port of the Ghostlock exploit), NebuSec (original exploit chain), John Red (bootloader vulnerability discovery) and Man Yue Mo (Mali GPU research that underpins the chain).
The privilege-escalation component is GhostLock, CVE-2026-43499, a use-after-free (CWE-416) in the Linux kernel rtmutex implementation (kernel/locking/rtmutex.c). NVD describes the fix as 'Use waiter::task instead of current in remove_waiter()'. Public analysis states that remove_waiter() assumes the thread performing cleanup owns the waiter; on the FUTEX_CMP_REQUEUE_PI path, when a deadlock cycle is detected during a priority-inheritance requeue, the kernel clears pi_blocked_on on the wrong task and leaves a dangling pointer into freed kernel stack memory. The original discoverers (reported as Nebula Security) reclaim the freed region with a shaped allocation, plant a forged kernel structure and obtain a controlled write, reportedly yielding a root shell about 97% of the time. NVD records the flaw as affecting Linux 2.6.39 through 7.0.3 (published 2026-05-21, CVSS 3.1 7.8 HIGH, AV:L/AC:L/PR:L), fixed in mainline 7.1 (commit 3bfdc63936dd per secondary reporting). Public ports adapt the exploit to Android 5.10 kernels on Amazon Fire devices.
The article also references Arm Mali GPU driver use-after-free flaws CVE-2022-38181 (in CISA KEV since 2023-03-30) and CVE-2022-46395 as foundational research (Man Yue Mo) for the chain; the exact role of each in this package is not detailed in the sources reviewed. The XDA release thread could not be fetched (HTTP 403), so chain internals beyond the article are not independently verified.
Capabilities reported after exploitation: persistent root via Magisk, TWRP recovery, unrestricted fastboot and Amlogic download (burn) mode, U-Boot command line over Ethernet, USB boot, and support for custom kernels and ROMs. Requirements: ADB debugging enabled with an authorized host connection, and 1.5 GB of user storage to maintain the unlock. The process performs an automatic factory reset, can permanently damage the device, and disables automatic firmware updates, which leaves the device on vulnerable firmware.
Defender relevance: this is a local, physical-or-ADB-authorized attack primarily used by owners for unlocking. Risk to organizations is from tampered or resold devices, hospitality or kiosk deployments, and the same GhostLock primitive affecting other unpatched Linux and Android 5.10/GKI 6.12 kernels. No IOCs were published and no official Amazon patch is discussed in the source.
MITRE ATT&CK techniques used in TL-2026-3393
Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1404 Exploitation for Privilege Escalation
Command and Control
Persistence
Defense Evasion
defense-impairment
Affected products and versions in Amazon Fire TV Cube 3 Exploit Enables Root Access and
- Amazon — Fire TV Cube (3rd generation, 'gazelle', AFTGAZL)
Vulnerable versions: Firmware PS7717 and older - Linux — Linux kernel (rtmutex, CVE-2026-43499)
Vulnerable versions: 2.6.39 through 7.0.3
Fixed in: 7.1 mainline and stable backports (6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.0.x) - Arm — Mali GPU Kernel Driver (CVE-2022-38181, CVE-2022-46395)
Vulnerable versions: Midgard r0p0-r32p0; Bifrost r0p0-r41p0; Valhall r19p0-r41p0
Fixed in: r42p0 and later (per CVE-2022-46395)
Remediation for Amazon Fire TV Cube 3 Exploit Enables Root Access and
Patches
- Apply vendor kernel updates containing the CVE-2026-43499 remove_waiter() fix where available; no Amazon Fire TV Cube patch is discussed in the source
Immediate actions
- Inventory 3rd-gen Fire TV Cube (AFTGAZL / gazelle) devices and confirm firmware version; PS7717 or older is in scope
- Disable ADB debugging and ADB over network on Fire TV devices not requiring it
- Isolate Fire TV devices on a segmented IoT/guest VLAN and restrict LAN access to TCP 5555
- Do not deploy second-hand or untrusted Fire TV Cube devices in managed environments without a factory-state check
Workarounds
- Keep ADB debugging disabled and restrict physical access to the device
- Block outbound and inbound ADB (TCP 5555) at the network edge
Longer-term hardening
- Keep automatic firmware updates enabled and monitor Amazon for a firmware that changes the bootloader and kernel
- Track kernel fix for CVE-2026-43499 (mainline 7.1 / stable backports) across Linux, Android GKI and embedded fleets
- Include consumer streaming devices in asset management and network access control
CVEs associated with Amazon Fire TV Cube 3 Exploit Enables Root Access and
Weaknesses (CWE) in Amazon Fire TV Cube 3 Exploit Enables Root Access and
Timeline of Amazon Fire TV Cube 3 Exploit Enables Root Access and
- Vulnerable rtmutex remove_waiter() behavior introduced in Linux 2.6.39-rc1 (approximate release date).
- Arm Mali GPU driver use-after-free CVE-2022-38181 published; later added to CISA KEV on 2023-03-30.
- Arm Mali GPU driver use-after-free CVE-2022-46395 published to NVD.
- CISA adds CVE-2022-38181 (Mali GPU driver UAF) to the Known Exploited Vulnerabilities catalog.
- Nebula Security reports the futex PI use-after-free (GhostLock) to Linux kernel maintainers (per Developers Digest).
- Upstream fix (commit 3bfdc63936dd) lands; mainline 7.1 contains the fix (per Developers Digest).
- CVE-2026-43499 (GhostLock, Linux kernel rtmutex remove_waiter use-after-free) published on NVD with kernel fixes landing.
- GhostLock technical details and exploit chain publicly disclosed by Nebula Security (per Developers Digest).
- NVD record for CVE-2026-43499 last modified (adds affected-version and vendor advisory detail).
- Version 1.2 of the Fire TV Cube 3 (gazelle) unlock/root package released on XDA by Pro-me3us.
- Cyber Security News reports the public exploit package enabling root and bootloader unlock on Fire TV Cube 3 firmware PS7717 or older; no in-the-wild abuse reported.
Update history for TL-2026-3393
- 2026-10-13 — Amazon Fire TV Cube (3rd gen, 'gazelle') flaws enable bootloader unlock and persistent root (CVE-2026-43499 GhostLock): What changed No severity, exploitability or status change; existing MEDIUM / POC_PUBLIC / ACTIVE remain appropriate (ADB prerequisite, no in-the-wild abuse). New indicators (15) Adds ADB/ksud/CoreELEC tooling, GhostLock public implementatio
Sources cited for Amazon Fire TV Cube 3 Exploit Enables Root Access and
- Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock
- XDA thread: Unlock/Magisk/TWRP Fire TV 3rd gen Cube (gazelle) PS7717
- NVD: CVE-2026-43499
- NVD: CVE-2022-38181
- NVD: CVE-2022-46395
- CISA Known Exploited Vulnerabilities Catalog (CVE-2022-38181 added 2023-03-30)
- GhostLock analysis (Masaryk University)
- GhostLock CVE-2026-43499 Linux kernel root exploit - patch now
- GhostLock exploit port for OnePlus (JoinChang)
- AFTVnews: Amazon is working on a 3rd-Gen Fire TV Cube code named Gazelle
Detection coverage for TL-2026-3393
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3393 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.