# Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock (CVE-2026-43499 Ghostlock)

> A public exploit package by XDA developer Pro-me3us gives temporary root and a bootloader unlock on the 3rd-generation Amazon Fire TV Cube ('gazelle', firmware PS7717 or older), using a port of the Linux kernel rtmutex use-after-free GhostLock (CVE-2026-43499) plus a bootloader flaw. It requires local ADB access, is not presented as a remote attack, and no malicious exploitation in the wild is reported.

- **Published:** 2026-10-13T10:09:41Z
- **Last reviewed:** 2026-10-13T11:40:13.175Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3393
- **ID:** TL-2026-3393
- **Severity:** MEDIUM (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-43499, CVE-2022-38181, CVE-2022-46395

## Description

On 2026-10-13 Cyber Security News reported a public exploit package, released by XDA developer Pro-me3us, that unlocks the bootloader and provides root on the 3rd-generation Amazon Fire TV Cube (model 'gazelle', build model AFTGAZL) running firmware PS7717 or older. The latest package version cited is 1.2, released 2026-09-30. The work credits several contributors: Pro-me3us (project lead and integration), mforce2 (port of the Ghostlock exploit), NebuSec (original exploit chain), John Red (bootloader vulnerability discovery) and Man Yue Mo (Mali GPU research that underpins the chain).

The privilege-escalation component is GhostLock, CVE-2026-43499, a use-after-free (CWE-416) in the Linux kernel rtmutex implementation (kernel/locking/rtmutex.c). NVD describes the fix as 'Use waiter::task instead of current in remove_waiter()'. Public analysis states that remove_waiter() assumes the thread performing cleanup owns the waiter; on the FUTEX_CMP_REQUEUE_PI path, when a deadlock cycle is detected during a priority-inheritance requeue, the kernel clears pi_blocked_on on the wrong task and leaves a dangling pointer into freed kernel stack memory. The original discoverers (reported as Nebula Security) reclaim the freed region with a shaped allocation, plant a forged kernel structure and obtain a controlled write, reportedly yielding a root shell about 97% of the time. NVD records the flaw as affecting Linux 2.6.39 through 7.0.3 (published 2026-05-21, CVSS 3.1 7.8 HIGH, AV:L/AC:L/PR:L), fixed in mainline 7.1 (commit 3bfdc63936dd per secondary reporting). Public ports adapt the exploit to Android 5.10 kernels on Amazon Fire devices.

The article also references Arm Mali GPU driver use-after-free flaws CVE-2022-38181 (in CISA KEV since 2023-03-30) and CVE-2022-46395 as foundational research (Man Yue Mo) for the chain; the exact role of each in this package is not detailed in the sources reviewed. The XDA release thread could not be fetched (HTTP 403), so chain internals beyond the article are not independently verified.

Capabilities reported after exploitation: persistent root via Magisk, TWRP recovery, unrestricted fastboot and Amlogic download (burn) mode, U-Boot command line over Ethernet, USB boot, and support for custom kernels and ROMs. Requirements: ADB debugging enabled with an authorized host connection, and 1.5 GB of user storage to maintain the unlock. The process performs an automatic factory reset, can permanently damage the device, and disables automatic firmware updates, which leaves the device on vulnerable firmware.

Defender relevance: this is a local, physical-or-ADB-authorized attack primarily used by owners for unlocking. Risk to organizations is from tampered or resold devices, hospitality or kiosk deployments, and the same GhostLock primitive affecting other unpatched Linux and Android 5.10/GKI 6.12 kernels. No IOCs were published and no official Amazon patch is discussed in the source.

## MITRE ATT&CK

- T1404 Exploitation for Privilege Escalation
- T1542 Pre-OS Boot
- T1601 Modify System Image
- T1059.004 Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1105 Ingress Tool Transfer
- T1553 Subvert Trust Controls

## Sources

- [Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock](https://cybersecuritynews.com/amazon-fire-tv-cube-3-exploit/)
- [XDA thread: Unlock/Magisk/TWRP Fire TV 3rd gen Cube (gazelle) PS7717](https://xdaforums.com/t/unlock-magisk-twrp-firetv-3nd-gen-cube-gazelle-ps7717.4800530/)
- [NVD: CVE-2026-43499](https://nvd.nist.gov/vuln/detail/CVE-2026-43499)
- [NVD: CVE-2022-38181](https://nvd.nist.gov/vuln/detail/CVE-2022-38181)
- [NVD: CVE-2022-46395](https://nvd.nist.gov/vuln/detail/CVE-2022-46395)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2022-38181 added 2023-03-30)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [GhostLock analysis (Masaryk University)](https://is.muni.cz/blog/cvt_fi/ghostlock)
- [GhostLock CVE-2026-43499 Linux kernel root exploit - patch now](https://falconinternet.net/blog/ghostlock-cve-2026-43499-linux-kernel-root-exploit-patch-now)
- [GhostLock exploit port for OnePlus (JoinChang)](https://github.com/JoinChang/ghostlock-oneplus)
- [AFTVnews: Amazon is working on a 3rd-Gen Fire TV Cube code named Gazelle](https://www.aftvnews.com/exclusive-amazon-is-working-on-a-3rd-gen-fire-tv-cube-code-named-gazelle/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3393