KernelSU

KernelSU is a root solution that lives in the Android kernel, not in the system partition. This APK is its manager app, which you use to decide which apps get root, install modules and check the status of your device. Installing the app by itself doesn’t root anything. Your device also has to run a kernel with KernelSU in it.

How KernelSU differs from Magisk

Magisk works by patching the boot image and running in user space. KernelSU does the root handling inside the kernel:

• su and access control are kernel-level. Root is granted from the kernel, and the manager app is where you approve or deny it.
• Whitelist by default. Only apps you have granted root can see su at all. Every other app can’t tell it is there.
• Modules, Magisk-style. KernelSU has its own module system that works much like Magisk’s. Modules that change system files need a metamodule, such as the official meta-overlayfs; script-only modules work without one.

For a side-by-side look at KernelSU, APatch and Magisk, see our root solutions comparison.

Will it work on your phone?

The project officially supports devices with a GKI 2.0 kernel (Linux 5.10 or newer), which covers most phones that launched with Android 12 or later. Older kernels back to 4.14 can work, but you have to build the kernel yourself. Since version 3.0 the project no longer publishes kernels with KernelSU built in (GKI mode), so on a supported phone you install it by having the manager patch your own boot image (LKM mode).

The manager app itself needs Android 12 or newer. Its native code is built for arm64-v8a and x86_64 only, so a phone that only runs 32-bit ARM code can’t use it.

What stands out in the APK

• No trackers. Nothing in the code matched any of the Exodus Privacy tracker signatures.
• Seven permissions, and only one prompt. The one Android asks you about is notifications. The rest are ordinary install-time permissions for networking, a foreground service and starting at boot. The manager doesn’t need broad permissions, because root is handled by the kernel.

Getting started

1. Check whether your device has a GKI kernel. The KernelSU website lists supported kernels and install methods.
2. Get a stock boot or init_boot image for your exact firmware. If your ROM only ships an OTA zip, Payload Dumper can extract it on the phone.
3. Install this manager app and have it patch your image, or since version 3.3.0 download and patch your firmware by its address. Our LKM install guide walks through the options.
4. Open the manager. It should report KernelSU as working, and from there you grant root per app.

Keep a copy of your stock boot image so you can flash it back if something goes wrong.

Who should skip it

• Your kernel is older than 4.14, or you aren’t willing to build a kernel for an older one.
• You rely on Magisk-only modules. Many work with KernelSU, but not all do.
• You don’t have an unlocked bootloader. No root solution will work without one.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); x86_64 (64-bit Intel, emulators and Chromebooks).

We host the current version and the 2 before it. Each older file matches the checksum in IzzyOnDroid’s signed index and is signed with the same key as the current one, so newer versions install over it as normal updates. The permissions and trackers listed above describe the current version. Full changelog.