A TCL TV Root Toolkit Leans on a Mali Bug CISA Flagged in 2023, on a 2024 Patch Level

A GitLab user going by c4psu13 created an MIT-licensed toolkit on Oct. 24 that claims to take an unprivileged app on a TCL 50C721 Android TV to root using CVE-2022-22706, an Arm Mali GPU driver bug published in March 2022. The firmware it targets reports a security patch level of March 5, 2024, nine months after Google's June 2023 bulletin listed the fix.

The claim comes from the project's README, and nobody independent has reproduced it. The author wrote that "No fresh rooting test was performed while preparing this source release." The README also says the toolkit is "not a universal TCL root tool or a supported installer", and it ships no prebuilt binaries.

What the bug is and what it needs

NVD describes CVE-2022-22706 as a flaw in which the Mali GPU kernel driver "allows a non-privileged user to achieve write access to read-only memory pages". It covers Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0 and Valhall r19p0 through r35p0. The score is 7.8 out of 10 on the CVSS severity scale, with a local attack vector and low privileges required.

The score understates what "local" means on a television. Any code that runs as an ordinary app on the set meets the precondition, and the README's chain starts from that position. The Arm fix is in Bifrost and Valhall r36p0 and Midgard r32p0, according to Techzine.

The chain the README describes

The tested unit is a TCL QLED 50C721 (BeyondTV6) on firmware V8-R51MT02-LF1V903, Android 11, kernel 4.14.198+, with a Realtek RTD1319 chip and a Mali-G31 GPU. The README lists four phases:

• Phase 1 uses the Mali page-cache write to alter in-memory pages of a shared library while the file on disk stays unchanged.
• Phase 3 waits for a normal C++ process start to run the altered code, which reaches a privileged domain and sets SELinux to Permissive.
• Phase 4a edits kernel credential structures through physical memory access to reach uid=0.
• Phase 4b applies hosts-file ad blocking, firewall rules and package disables, then sets SELinux back to Enforcing.

The recorded result is an ADB shell at uid=0, in "under 2 seconds" by the author's account. The root is tethered: a reboot clears the page-cache patch, bind mounts and iptables rules, though package disables survive. The author warns against flashing patched boot or vbmeta images, saying two earlier attempts bootlooped.

A patch level that does not settle the question

CVE-2022-22706 is not an obscure bug. CISA added it to its Known Exploited Vulnerabilities catalog on March 30, 2023, with an April 20, 2023 due date for federal agencies. The Android Security Bulletin of June 5, 2023 carried the note "There are indications that CVE-2022-22706 may be under limited, targeted exploitation."

1. Added to CISA KEV (Mar. 30, 2023)392 days
2. Android bulletin 2023-06-05459 days
3. Tested TV patch level (Mar. 5, 2024)733 days
4. Toolkit repository created (Oct. 24, 2026)1696 days

Source: NVD, Android Security Bulletin June 2023, project README, accessed 2026-10-24

A device that reports a 2024 patch level should not carry a 2022 flaw, yet the README records a patch level of 2024-03-05 and a working chain. The README does not resolve this. It says its original records disagree on the chip identification and the Mali driver revision, and it does not say whether newer TCL builds are fixed. Either the vendor's patch-level string does not track the GPU driver or the written record is wrong, and only a fresh test on that firmware would say which.

Old flaws staying useful is a pattern the site has already logged: SafePay's five named CVEs are all two years old or more, and PHP's CVE-2026-115560 shows the opposite case, a bug with no patch at all.

Owners of the 50C721 have no vendor guidance in the sources reviewed. The practical step is to keep untrusted apps off the set until TCL names a firmware that ships a Mali driver at r36p0 or later.