GhostLock Brings Temporary Root Access to Fire TV Stick 4K Max

A newly released security exploit can provide temporary root access on the second-generation Fire TV Stick 4K Max.

Developer Rortiz2 published the Fire TV version of GhostLock on August 18, 2026. The release adapts a Linux kernel vulnerability identified as CVE-2026-43499 to the 2023 Fire TV Stick 4K Max, which has the internal codename karat and runs Fire OS 8.

This is different from the loose use of the word “jailbreak” for enabling developer options or installing an ordinary app outside the Amazon Appstore. GhostLock is a local privilege escalation exploit that can produce a root shell with the highest level of access on the device.

This article is news and security information. It does not provide instructions, downloads, or commands for rooting a Fire TV, disabling security features, blocking updates, or bypassing Amazon’s restrictions.

The exploit targets one Fire TV model

The Fire TV release officially supports the Fire TV Stick 4K Max 2nd Gen from 2023. It does not claim support for the first-generation Fire TV Stick 4K Max, which uses the codename kara and runs Fire OS 7.

It should also not be confused with the second-generation Fire TV Stick 4K, formerly sold as the Fire TV Stick 4K and now marketed in some regions as the Fire TV Stick 4K Plus. That device uses the codename mantra and has different hardware specifications.

The developer lists tested Fire OS versions from 8.1.4.5 through 8.1.8.0. That range includes the two recent 8.1.8.0 builds identified as RS8180.3729N and RS8180.3739N, along with several builds in the 8.1.5, 8.1.6, and 8.1.7 branches.

The list describes builds tested with this specific port. It is not proof that every Fire OS device with a similar kernel is compatible. Kernel layout, device configuration, and Amazon’s per-model software changes can affect whether a privilege escalation technique works.

Root access is temporary

GhostLock does not permanently replace Fire OS or install a custom operating system. It creates a temporary root shell while the device remains powered on.

The elevated access ends after a reboot. The exploit would need to succeed again before another root session could be created. Applications also do not automatically receive root access simply because the exploit has run.

Temporary does not mean harmless. Actions performed during a root session can still alter device state, remove data, disable packages, or damage software needed for startup. Some configuration changes can remain after the root session itself has disappeared.

The developer says the release was not patched on the tested builds as of August 18. Amazon had not published a Fire TV advisory naming GhostLock or CVE-2026-43499 when the release appeared.

GhostLock uses a Linux kernel flaw

CVE-2026-43499 is a use-after-free flaw in the Linux kernel’s real-time mutex code. It can be reached through the futex requeue path when the kernel handles a rollback involving a waiting task.

In simpler terms, the kernel can retain an invalid reference after memory associated with one operation should no longer be used. A carefully constructed local process can turn that memory-safety error into elevated privileges.

The National Vulnerability Database rates CVE-2026-43499 as high severity with a CVSS 3.1 score of 7.8. Its assessment describes a local attack requiring low privileges and no additional user interaction after the vulnerable code is reached.

The underlying bug existed in Linux for many years and has been fixed in supported upstream kernel branches. Fire OS uses an Amazon-maintained Android-based software stack, so the presence of an upstream fix does not establish when a particular Fire TV build receives it.

Amazon has already published fixes for CVE-2026-43499 in several Amazon Linux releases. Those server and cloud operating system advisories are separate from Fire OS, and they should not be treated as confirmation that the Fire TV kernel has been updated.

This is not a bootloader unlock

Root access inside a running Fire OS session is not the same as unlocking the bootloader.

The bootloader controls which software the device accepts during startup. GhostLock does not remove verified boot protections, replace the bootloader, install a custom recovery, or make protected system partitions safe to modify.

That distinction is important because the developer gives an unusually strong warning about the limits of the release. The Fire TV Stick continues to enforce dm-verity, which checks protected partitions. Modifying the system or vendor partitions can leave the device unable to start.

The warning is even stronger for low-level firmware areas such as the bootloader, trusted execution environment, and preloader. The developer says damaging those areas can permanently brick the device because there is no working public USB recovery path for this model.

Owners should therefore treat GhostLock as experimental security research, not as a routine customization feature.

What ordinary Fire TV owners should know

The public release does not mean every Fire TV Stick 4K Max can suddenly be compromised over the internet without access to the device.

The published Fire TV implementation is a local exploit. Its normal use requires code to be transferred to and executed on the Fire TV through Android Debug Bridge access. A Fire TV with ADB debugging disabled does not expose that intended route.

Owners who do not conduct device security research should leave ADB debugging turned off, avoid untrusted exploit packages, and continue installing official Fire OS updates. Amazon lists the second-generation Fire TV Stick 4K Max for software security updates through at least December 31, 2030.

Security updates matter in this case because a future Fire OS release can include a corrected kernel. Anyone who intentionally blocks updates remains on older system components and may miss fixes unrelated to GhostLock as well.

It is also wise to be skeptical of sites that repackage the release as a one-click “jailbreak.” Executables that request root-level access are especially sensitive. A modified package can do much more than the public source code claims, and antivirus warnings should not be dismissed without independent verification.

What happens next

The immediate question is how quickly Amazon updates the kernel on affected Fire TV builds. A new version number alone will not prove that the flaw has been fixed. Confirmation will require a security notice, a kernel change, or careful testing by researchers.

The second question is whether the Fire TV port expands to other devices. The public GhostLock repository also supports the Fire Max 11 tablet, but its Fire TV target remains the second-generation Fire TV Stick 4K Max. Similar Fire OS version numbers do not guarantee that another Stick, Cube, television, or tablet is vulnerable in the same way.

The release is still notable even with those limits. In March, public hardware research concluded that the karat model had no available root method. Five months later, a kernel flaw now provides a temporary path to elevated access on multiple current Fire OS 8 builds.

For most owners, the practical response is simple. Keep the device updated, leave debugging disabled when it is not needed, and wait for Amazon or security researchers to confirm when the Fire TV kernel includes the upstream correction.