How to Root Google Pixel with Locked Bootloader (No Unlock) | GhostLock Exploit Guide
📅 Updated: September 12, 2026 | ✅ Fact-checked & verified
Root Google Pixel 6, 7, 8, 9, 10, and Fold devices with a LOCKED bootloader using the GhostLock exploit. Complete step-by-step tutorial with ReSukiSU temporary root — no bootloader unlock, no data wipe, no warranty void.
Table of Contents
- What Is the GhostLock Exploit?
- Why Root Google Pixel with Locked Bootloader
- Essential Requirements
- Step-by-Step: Root Google Pixel with Locked Bootloader
- How to Verify Root
- Common Problems and Troubleshooting
- Risks and Warnings
- Video Guide
- Download Links
- FAQs
⚠️ Important Disclaimer
⚠️ DEVELOPMENT & LEARNING PURPOSES ONLY
This guide is provided strictly for development, security research, and educational purposes. The GhostLock exploit leverages a kernel-level use-after-free vulnerability (CVE-2026-43499). Misuse of this technique on devices you do not own is illegal. Touching any stock binary, partition, or boot image can result in bootloops, soft bricks, or hard bricks. The author and GSM6 are not responsible for any damage, data loss, or legal consequences.
What Is the GhostLock Exploit?
The GhostLock exploit is a kernel-level privilege escalation technique that grants temporary root access on locked-bootloader Android devices.
The vulnerability, tracked as CVE-2026-43499, is a use-after-free bug in the Linux kernel’s rtmutex.c file, specifically in the remove_waiter() function. This bug has existed in the Linux kernel since 2011 and affects a wide range of Android devices — including every Google Pixel released since the Pixel 6.
How GhostLock Works
| Stage | Description |
|---|---|
| 1. Race Condition | Crafted multi-threaded operations trigger a race in the futex priority inheritance subsystem |
| 2. Kernel R/W Primitive | The dangling pointer is manipulated to obtain a temporary kernel read/write primitive |
| 3. Module Injection | A KernelSU module (kernelsu.ko) is late-loaded into the running kernel |
| 4. Root Access | KernelSU grants superuser access to authorized shells and apps — without modifying the boot image |
Key Point: Because nothing is written to the boot image or any partition, the bootloader stays locked, the device stays verified, and root access is lost on reboot.
Why Root Google Pixel with Locked Bootloader
Until now, rooting a Google Pixel required unlocking the bootloader — which wipes all data, voids warranty, and is impossible on carrier-locked devices (Verizon, AT&T). The GhostLock exploit changes that entirely.
| Traditional Root | GhostLock Root |
|---|---|
| Bootloader unlock required | Locked bootloader supported |
| Data wipe mandatory | No data loss |
| Warranty voided | Warranty unaffected |
| Carrier-locked devices blocked | Works on carrier-locked devices |
| Permanent root | Temporary root (until reboot) |
| Fastboot/PC required | Can be done entirely on-device |
Our Testing Experience: We tested the GhostLock method on multiple Pixel 7 and Pixel 8 devices running Android 16 and Android 17 builds. Devices with August 2026 and September 2026 security patches rooted successfully. The method relies on specific firmware offsets — if your build is not listed as supported, the exploit will fail and the tool will refuse to run.
Root My Pixel app running the GhostLock exploit to late-load ReSukiSU
Essential Requirements
| Requirement | Details | Importance |
|---|---|---|
| Supported Build | August 2026 or September 2026 Pixel firmware | CRITICAL |
| Shizuku APK | Grants elevated shell permissions to Root My Pixel | Required |
| Root My Pixel APK | Frontend for the GhostLock exploit | Required |
| ReSukiSU APK | KernelSU manager to verify and manage root | Required |
| GSM6 Pixel Tool Pro | Optional — for PC-side root verification | Recommended |
| ADB Drivers | Windows only — for PC-side verification | Optional |
Step-by-Step: Root Google Pixel with Locked Bootloader
Step 1: Install the Required APKs {#install-apks}
Install these three APKs on your Pixel. You can push them via GSM6 Pixel Tool Pro or copy them to internal storage and install manually.
| APK | Purpose | Download |
|---|---|---|
| Shizuku | Provides elevated shell permissions to Root My Pixel | GitHub |
| Root My Pixel | Runs the GhostLock exploit to install ReSukiSU | GitHub |
| ReSukiSU | KernelSU manager — verifies and manages root | GitHub |
After installing all three APKs, reboot your phone normally.
The three APKs required for the GhostLock locked-bootloader root method
Step 2: Pair and Start Shizuku {#shizuku}
- Launch Shizuku from your app drawer.
- Tap “Pair” on the Shizuku home screen.
- Go to Settings > System > Developer Options > Wireless Debugging.
- Tap “Pair device with pairing code”.
- Enter the PIN code shown on your screen into Shizuku.
- Once pairing succeeds, open Shizuku again and tap “Start”.
You should see a notification confirming “Shizuku is running”.
Step 3: Run the GhostLock Exploit via Root My Pixel {#exploit}
- Launch Root My Pixel.
- Tap “Install ReSukiSU”.
- Let the app process the exploit.
If your build is supported, the exploit will pass and ReSukiSU will be late-loaded into the kernel. If your build is not supported, the tool will return an error and refuse to run.
Currently supported builds: August 2026 and September 2026 Pixel firmware only.
Step 4: Verify Root in ReSukiSU {#verify-root}
- Launch ReSukiSU from your app drawer.
- The manager should show the KernelSU module as loaded and active.
- Go to the Superuser tab — you should see entries for Root My Pixel, Shizuku, and Shell.
If ReSukiSU shows the module as active, root is working.
Step 5: Verify Root with GSM6 Pixel Tool Pro {#verify-tool}
For PC-side verification:
- Connect your phone to your PC via USB.
- Open GSM6 Pixel Tool Pro.
- Click “Read Info”.
- Look for the Root State line in the output.
| Output | Meaning |
|---|---|
| Root State: Active | Root is working — GhostLock exploit succeeded |
| Root State: Inactive | Root is not currently active |
Note: Because this is a temporary root, the state reverts to Inactive after every reboot. You must re-run the exploit to regain root.
How to Verify Root
You can verify root status in three ways:
Method 1: ReSukiSU Manager
Open the ReSukiSU app — if the KernelSU module shows as loaded, root is active.
Method 2: GSM6 Pixel Tool Pro
Click Read Info in the tool. Look for Root State: Active.
Method 3: ADB Shell
From a PC with ADB:
adb shell "sh -c 'id'"If the output contains uid=0(root), root is active.
Common Problems and Troubleshooting
Problem A: Shizuku Shows “Not Connected”
Cause: Shizuku service was not started after pairing.
Solution: Open Shizuku, tap Start again. If it still fails, reboot and re-pair via Wireless Debugging.
Problem B: Root My Pixel Shows an Error During Exploit
Cause: Your build is not supported, or the KernelSU manager signature check failed.
Solution: Verify your build number matches the supported list (August 2026 / September 2026). If it does, ensure ReSukiSU is installed before running Root My Pixel.
Problem C: Root State Shows “Inactive” After Reboot
Cause: This is expected. GhostLock provides temporary root only.
Solution: Re-run Root My Pixel and let it late-load ReSukiSU again. Root will be restored until the next reboot.
Problem D: GSM6 Pixel Tool Pro Shows “N/A” Instead of “Root State”
Cause: Older versions of GSM6 Pixel Tool Pro may not include the Root State detection feature.
Solution: Update to the latest version of GSM6 Pixel Tool Pro from the official download page.
Risks and Warnings
| Risk | Description |
|---|---|
| Bootloop | Touching any stock binary or partition can cause the device to fail to boot |
| Soft Brick | Incorrectly running the exploit can leave the device in a recoverable but non-functional state |
| Hard Brick | In rare cases, partition corruption can render the device permanently unusable |
| Anti-Rollback | Pixel 10 series with May 2026+ bootloader cannot downgrade — attempting to flash older firmware will hard-brick the device |
| Temporary Root Only | Root is lost on every reboot; the exploit must be re-run each time |
| Security Exposure | Root access bypasses Android’s security isolation |
| OTA Updates | System integrity checks may fail; manual updates required |
This guide is for development and learning purposes only. Proceed at your own risk.
Video Guide
Complete video walkthrough for rooting Google Pixel with locked bootloader using the GhostLock exploit:
Video Tutorial
Watch this guide for visual instructions
Uploaded: September 12, 2026
Device: Google Pixel 7 (Android 16) — Method works for Android 17 builds as well.
Subscribe for more tutorials:
Download Links
| File/Tool | Description | Download Link |
|---|---|---|
| GSM6 Pixel Tool Pro | All-in-one Pixel toolkit | GSM6 Pixel Tool Pro |
| Shizuku APK | Elevated shell permissions | GitHub Releases |
| Root My Pixel APK | GhostLock exploit frontend | GitHub Releases |
| ReSukiSU APK | KernelSU manager | GitHub Releases |
| ADB & Fastboot Tools | Essential command-line tools | Platform Tools |
| Android USB Drivers | Windows drivers for ADB | GSM6 USB Drivers Guide |
Frequently Asked Questions
Can I root my Google Pixel without unlocking the bootloader?
Yes — using the GhostLock exploit (CVE-2026-43499) via the Root My Pixel app. This method late-loads a KernelSU module into the running kernel without touching the boot image, so the bootloader stays locked and no data is wiped. Root is temporary and is lost on reboot.
Is this root method permanent?
No. The GhostLock exploit provides temporary root only. Root access is lost every time the device reboots. You must re-run the exploit via Root My Pixel to regain root access.
Will this method work on my Pixel?
It only works on supported builds — currently August 2026 and September 2026 Pixel firmware. If your build is not supported, the exploit will fail and the tool will refuse to run. Check the Root My Pixel GitHub page for the latest supported build list.
Does this method wipe my data?
No. Unlike traditional bootloader-unlock rooting, the GhostLock method does not modify any partition and does not wipe your data. Your apps, files, and settings remain intact.
Will this void my warranty?
No. Because the bootloader is never unlocked and no partitions are modified, the warranty-voiding event log is never triggered. However, this guide is for development and learning purposes only — proceed at your own risk.
Why do I need Shizuku?
Shizuku provides elevated shell permissions to the Root My Pixel app. The GhostLock exploit requires shell-level access to trigger the kernel race condition. Without Shizuku running, Root My Pixel cannot perform the exploit.
Why do I need ReSukiSU?
ReSukiSU is the KernelSU manager that the GhostLock exploit late-loads into the kernel. It provides the actual root access — the su binary, superuser management, and the root context used by apps and shells.
Can I use Magisk instead of ReSukiSU with this method?
No. The GhostLock exploit is specifically designed to late-load a KernelSU-family module. Magisk works by patching the boot image, which requires an unlocked bootloader. For locked-bootloader root, you must use a KernelSU-family manager like ReSukiSU.
What happens if my device bootloops after running the exploit?
Reboot into fastboot and re-flash the original boot image. Because GhostLock does not modify any partition, a simple reboot usually restores the device to a clean state. If the device does not recover, flashing the full stock factory image via fastboot will restore it.
Can I use this method on a carrier-locked Pixel?
Yes — this is one of the major advantages of the GhostLock method. Because it does not require bootloader unlock, it works on carrier-locked devices (Verizon, AT&T) where OEM Unlocking is grayed out.
How do I verify root is working?
Open ReSukiSU — if the KernelSU module is loaded, root is active. You can also use GSM6 Pixel Tool Pro: click Read Info and look for Root State: Active.
Does this method work on Android 17?
Yes — as of September 2026, the GhostLock exploit has been tested on Android 17 August 2026 and September 2026 builds. Support for future builds depends on the Root My Pixel developer updating the target offsets.
Is the GhostLock exploit safe?
It is as safe as any kernel exploit can be. The most common failure mode is a kernel panic followed by a clean reboot into stock Android — no data loss, no brick. But a won race can still leave priority inheritance state that causes kernel faults later, and touching any stock binary or partition carries a brick risk. Always back up your data first.
Do I need a PC to root my Pixel with GhostLock?
No. The entire method can be done on-device using just the three APKs and Shizuku’s wireless pairing. A PC is only needed if you want to verify root with GSM6 Pixel Tool Pro via ADB.
Connect with the Author & Community
- Learn with AM - YouTube Channel
- GSM6 Official YouTube Channel
- Telegram Community
- GSM6 Community Forum
© 2026 GSM6.com | Root Google Pixel Locked Bootloader Guide
This guide is provided for educational, development, and security research purposes only.
Touching stock binaries or partitions can cause bootloops or bricks. Proceed at your own risk.
Author:
Abdul MalikMobile Software Expert and founder of GSM6.com. Specializes in FRP bypass, IMEI repair, and advanced mobile tools. All tutorials are tested on real devices for accuracy and safety.
