CVE-2026-65349 — getattrlist OOB Write in vfs_attr_pack_internal

Component: XNU VFS — vfs_attr_pack_internal (getattrlist syscall)
Affected: iOS / iPadOS 26.6 (23G71) and earlier
Fixed in: iOS / iPadOS 26.6.1 (23G83)
Type: Out-of-Bounds write to caller buffer
Impact: Kernel heap corruption; from kernel context (after kernel r/w), enables writing a PAC-signed pointer to an attacker-controlled buffer

Credits

Discovered by an anonymous researcher
(per Apple Security Advisory — iOS 26.6.1)

Root Cause

vfs_attr_pack_internal iterates over the requested attribute bitmap and writes each attribute into the caller's buffer sequentially. It does not check whether the running output offset has exceeded bufsize before writing attribute slot 51 (SETXATTR_SLOT).

For a file with a 16-character name, the full valid attribute output is 0x1a4 (420) bytes. Slot 51 starts at offset 0x198 (408 bytes). When the caller supplies a buffer smaller than 0x198 + 8, the kernel writes 8 bytes past the end of the buffer:

; vfs_attr_pack_internal (affected path, 26.6 / 23G71)
; slot 51 write — no bounds check before store
str  x_attr_data, [buf + 0x198]   ; OOB if bufsize < 0x198 + 8

Attribute Bitmap

The valid attribute masks verified by on-device probe (getattrlist on a 16-character filename, iOS 26.6):

With these masks on a 16-char filename, total output = 0x1a4 bytes. OOB occurs at slot 51 (buf+0x198) whenever bufsize < 0x1a0.

iOS 26 Exploitation Notes

On iOS 26, KHEAP_TEMP isolation prevents the OOB write from directly corrupting adjacent heap allocations in a useful way from userspace. The bug is classified as kernel-heap only in this research:

• From userspace: OOB write hits caller's own user-stack/heap — observable but not exploitable for privilege escalation without an additional primitive.
• From kernel context (after a kernel write primitive from CVE-2026-64788): write a PAC-signed pointer into a kernel buffer via the OOB offset, then trigger vfs_attr_pack_internal from a controlled call site.

In the iOS 26.6 jailbreak chain, this bug is used in the final stage to write a PACIA-forged pointer into a kernel allocation adjacent to the caller buffer.

PoC Behaviour

poc_getattrlist_oob.c demonstrates the OOB boundary with three calls:

The PoC creates a 16-character filename (/var/root/aaaaaaaaaaaaaaaa) as the test target, runs all three getattrlist() calls, and prints the return codes. A kernel panic log (if triggered) will show a fault at buf+0x198.

Requirements

• iOS 26.6 (23G71) or earlier
• /var/root/ write access (for creating the 16-char test file; path can be adjusted to any writable location)
• No entitlements required

Build

# Standalone C binary — no frameworks needed
clang -arch arm64 -o poc poc/poc_getattrlist_oob.c

# For on-device:
clang -arch arm64 -isysroot $(xcrun --sdk iphoneos --show-sdk-path) \
      -o poc poc/poc_getattrlist_oob.c
codesign -s "Apple Development" poc

Timeline

References

• Apple Security Advisory — iOS 26.6.1