Qualcomm’s latest flagship processor, the Snapdragon 8 Elite Gen 5, is currently widely used in devices such as the Xiaomi 17 series, OnePlus 15, and the newly released Galaxy S26 Ultra. A recently discovered vulnerability makes it possible to unlock the bootloader on these devices, which are traditionally known for their strict security locks.
The GBL Flaw Affecting Xiaomi 17 and Android 16 Devices
This vulnerability stems from a flaw in the Generic Bootloader Library (GBL) architecture on devices running Android 16. Qualcomm’s Android Bootloader (ABL) fails to verify the authenticity of files when loading the GBL from the “efisp” partition, checking only if it is a UEFI application. This lack of verification allows unsigned code to be loaded and executed on the system.
The Exploit Chain: Bypassing SELinux
Under normal conditions, writing data to this partition is blocked by the SELinux firewall. However, a vulnerability in the fastboot oem set-gpu-preemption command—which fails to sanitize external arguments—allows for system interference. By adding the androidboot.selinux=permissive parameter to this command, the SELinux protection is disabled, granting write access to the system.
When combined with the IMQSNative service of the MQSAS application in Xiaomi’s HyperOS, this chain of errors allows a custom UEFI application to be written to the “efisp” partition. Upon reboot, this application sets the is_unlocked and is_unlocked_critical values to “1,” completely bypassing the bootloader lock. This process functions identically to the standard official unlocking command.
Impact and Patch Status
This method has been successfully tested on the Xiaomi 17 series, Redmi K90 Pro Max, and POCO F8 Ultra. It effectively bypasses Xiaomi’s strict, survey-based bootloader unlocking rules in the Chinese market. It is reported that Xiaomi patched this flaw with the HyperOS 3.0.304.0 update released yesterday.
Note for Samsung Users: The GBL vulnerability is said to affect most manufacturers except Samsung, which utilizes its proprietary S-Boot system. However, different exploit methods may be required for other brands.
Official Statements
Qualcomm officials expressed gratitude to the Xiaomi ShadowBlade Security Laboratory for their coordinated disclosure. The company emphasized that fixes were provided to clients in early March 2026 and urged all users to install the latest security updates immediately, as these patches will render the current exploit ineffective.
Do you feel the need to modify your smartphone’s system files? Which device are you currently using, and how important is bootloader flexibility to you?
