important · Boot chain — physical
A fastboot command can turn a locked Poco M7 Plus into a temporarily rooted device.
Affects
Poco M7 Plus 5G smartphones running Xiaomi HyperOS on the Qualcomm SM6375 platform.
The command injects androidboot.selinux=permissive through an unsanitized ABL parameter while the bootloader remains locked.
Detail and 6 sources
The demonstrated route needs physical USB access and a compatible root manager already installed, and the resulting root state ends at reboot.
Sources
ResearchCVE-2026-24088 - Vulnerability-LookupResearchDownload ROM POCO M7 Plus 5G: pembaruan terbaru HyperOS 3Code / PoCPOCO-M7-Plus-Jailbreak/GBL-AutoRoot.bat at main · aniketlab/POCO-M7-Plus-Jailbreak · GitHubCVECVE-2026-24088 - Missing Authentication for Critical Function in BootSecondaryNew Poco M7 Plus validation automates a locked-bootloader Qualcomm root pathSecondaryAndroid Security Bulletin—September 2026 | Android Open Source Project