KernelSU Next

KernelSU Next is a root solution that lives in the Android kernel, forked from KernelSU. This APK is its manager app: it patches boot images, decides which apps get root and installs modules. The app alone doesn’t root anything; the kernel has to run the KernelSU Next driver, either as a module loaded from a patched boot image or built into the kernel.

How it differs from KernelSU

KernelSU Next’s README credits the original as “the original base that made KernelSU Next possible”, and many fixes in recent releases are ports of KernelSU’s own, each linked in the release notes. The differences:

• Older kernels. KernelSU announced in 2024 that it would “give up supporting non-GKI kernels in version 1.0”. KernelSU Next keeps a legacy branch that kernel builders can use for them.
• An older Android for the app. The manager installs on Android 8.0 and later; KernelSU’s needs Android 12.
• A module catalogue in the app, read from the project’s curated lists. A second list of closed-source modules is off by default, under Non-Free Repository.
• Risk detection when you install a module, on by default: the manager checks the module against a list of known malicious ones. A low or medium match pauses the install and asks you to press volume down within five seconds to go on; high and extreme ones are blocked.
• App lock with the screen lock or fingerprint, and backups of your module list and root allowlist.
• SUSFS, a kernel module for hiding root from detection, which 3.4.2 can load on GKI kernels with 64-bit ARM. In the README’s words, it is “A kernel-level root-hiding extension for KernelSU”, from the susfs4ksu-lkm project. It is loaded only when you tap Load in the settings, or at every start if you turn on auto-load, which is off by default; it refuses to load when SUSFS is already built into the kernel.

The two projects aren’t interchangeable. A KernelSU Next kernel only accepts a manager signed with KernelSU Next’s certificate, and KernelSU’s kernel expects a different one, so KernelSU’s manager shows nothing useful on a KernelSU Next kernel, and the other way round.

Will it work on your phone?

• GKI 2.0 kernels, Linux 5.10 and newer (most phones that launched with Android 12 or later): the manager patches your stock image with a kernel module it carries. Version 3.4.2 includes modules for every Android kernel generation from android12-5.10 to android17-6.18. The app recommends the boot image on 5.10 kernels and init_boot on newer ones.
• Kernels 4.19 to 5.4, and older: you need a kernel built with the KernelSU Next driver. The project says it can’t offer ready-made images for these, “Due to the fragmentation of non-GKI kernels”; such kernels come from other developers, and the project’s own device list warns: “be cautious about what you are flashing!”
• x86_64 kernels: the README warns that recent kernel changes can make KernelSU Next fail and “potentially trigger a kernel panic”.
• The app has native code for 64-bit ARM, x86_64 and RISC-V. There is no 32-bit ARM code, so a phone that only runs 32-bit apps can’t install it; since 3.4.2 the README no longer lists 32-bit ARM either.

Like KernelSU since 3.0, the release has no ready-made kernels or AnyKernel3 zips; on a GKI phone the patched image is the way in.

Getting started

1. Unlock the bootloader. KernelSU Next’s documentation doesn’t spell it out, but every install method flashes a boot image or kernel; KernelSU’s FAQ answers the same question with “Yes. KernelSU requires an unlocked bootloader.”
2. Get the stock boot or init_boot image for your exact firmware. Our guide on extracting a boot image covers the usual ways, including Payload Dumper on the phone.
3. Patch it in the manager with Install › Select a file, then flash the result with fastboot. Our LKM and GKI guide, written for KernelSU, applies to the same steps here.
4. Install a metamodule from the manager’s Meta Module screen if you want modules that change system files. Without one, modules aren’t mounted.

Once it works, Direct install updates it in place, and Install to inactive slot re-roots after an OTA update; the app warns that the phone will then be “FORCED to boot to the current inactive slot after a reboot!”. Keep your stock image: in LKM mode the app can Restore stock image or Uninstall permanently, but with a kernel that has the driver built in, the way back is flashing your stock kernel.

When you update the app, also update the kernel module: after an update the app may show Kernel update required until you do, and the lead developer’s advice in such reports is “Just update LKM”.

What goes online

From the 3.4.2 source code:

• An update check on GitHub each time you open the home screen. It’s on by default and can be turned off (Check for updates). An update opens in your browser; the app doesn’t install it by itself.
• Five contributor pictures loaded from GitHub on the home screen, kept in the app’s image cache.
• Each installed module’s own update address, chosen by the module’s author, when KernelSU Next is working.
• The risk list, downloaded from the project’s GitHub when you install a module, with a copy in the app as a fallback.
• The module catalogue, from the project’s GitHub, and App Profile templates, from kernelsu.org, the original project’s site, only when you open those screens.

We found no analytics, crash-reporting or advertising code.

About this file

• This is the normal build of version 3.4.2, released on 13 October 2026, from the project’s GitHub releases, package com.rifsxd.ksunext, signed by Rifat Azad, the lead developer; its SHA-256 matches the hash GitHub publishes for that release file. Separately, the kernel only accepts a manager signed with the project’s certificate: it checks the certificate’s SHA-256, so a copy re-signed by anyone else would show Not installed even on a working kernel.
• We don’t host the spoofed build. It is the same app under a random package name, generated once per release and so the same for everyone who installs that release; a contributor describes its purpose as hiding the manager from banking apps. Because the name changes with every release, a collaborator warns: “You cannot update in place.”
• New in 3.4.2: the SUSFS module described above; Block kernel modules (risky), an install option, off unless you tick it, that stops kernel modules you list from loading at boot, which the app warns “can make the device hang on the boot logo or bootloop”; and Restrict shell root to ADB, off by default, which lets only ADB sessions use root granted to the shell. 3.4.1 added the app lock, optional haptic feedback and a time limit for modules’ boot scripts.
• The 16.7 MB file, most of whose growth is the SUSFS modules, runs on Android 8.0 and later and declares four permissions: internet, fingerprint and biometric unlock for the app lock, and one AndroidX uses internally. Root itself goes through the kernel, not Android permissions.
• The APK doubles as a zip you can flash from a custom recovery to patch the boot image; renamed to contain “uninstall”, it removes KernelSU Next instead.
• KernelSU Next’s kernel code is licensed under the GPL-2.0, and everything else under the GPL-3.0 or later. The source of this version is at https://github.com/KernelSU-Next/KernelSU-Next/tree/v3.4.2.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); riscv64; x86_64 (64-bit Intel, emulators and Chromebooks).

Recent releases on the project’s GitHub. We host and check only the newest one. Full changelog.