Definition
A kernel memory bug where a live reference to a physical memory page persists after the kernel frees it. When exploited from the right context, a page UAF can provide stable physical page-level read/write primitives largely independent of kernel version, slab hardening, KASLR, and CFI.
Key Points
- 2026-09: Core primitive in oempocalypse chains targeting OEM kernel drivers on Samsung, Xiaomi, Oppo devices (2026-09-14-oempocalypse-android-root)
- Requires no KASLR leak and hijacks no control flow — slab protections and CFI become irrelevant
- Same page-reclamation code worked unchanged on Linux kernels 5.15 through 6.12
- Reached via sandbox-escape when SELinux gates the target OEM driver behind a privileged domain