CVE-2026-28992 — IOHIDFamily FastPathUserClient PoC

Security research repository. Two PoC apps demonstrating the race conditions in IOHIDFamily's FastPathUserClient on iOS 18.7.1 and earlier.

⚠️ Both PoCs will kernel-panic and reboot your device. Save your work first.

Vulnerability Summary

Root Cause

sel0 (open/gate) checks FastPathHasEntitlement and FastPathMotionEventEntitlement in the caller-supplied OSDictionary rather than the entitlement flags stored during initWithTask. A sandboxed app passes the gate by including those keys in its input dict.

Two vectors follow from there:

UAFPoc — Use-After-Free

UAFPoc/UAFPoc.xcodeproj

Race: close (sel1) drops provider state and clears offset +0x109 without a lock. copyEvent (sel2) checks offset +0x108 under a per-connection lock, then calls into the provider. Multiple connections to the same provider mean close and copyEvent run in different locking domains on the same shared provider-side objects.

Crash type:

• A17+ (MTE): kernel MTE tag check fault
• Pre-A17: kernel data abort

AOPPanicPoc — AOP Coprocessor Watchdog

AOPPanicPoc/AOPPanicPoc.xcodeproj

Race: mach_port_destroy triggers async didTerminate → teardown, unsynchronized with concurrent sel0 open paths on other connections. Teardown frees provider-facing state while opener threads iterate it. Also saturates SPU-backed providers' mailbox → AOP watchdog timeout.

How to Build & Sideload

Requirements

• macOS with Xcode 15+
• Apple Developer account (free tier works for sideloading)
• iPhone 16e on iOS 18.7.1 (or any iOS 15.0–18.7.8 / 26.0–26.4.x device)

Steps

git clone https://github.com/clogan9019-dotcom/IOHIDFamily-PoC-Research.git
cd IOHIDFamily-PoC-Research

UAF variant:

1. Open UAFPoc/UAFPoc.xcodeproj in Xcode
2. Select your device in the top bar
3. Set your Team in Signing & Capabilities (your Apple ID is fine)
4. Product → Run (⌘R) — Xcode will install and launch it directly

AOP variant:

1. Open AOPPanicPoc/AOPPanicPoc.xcodeproj in Xcode
2. Same signing steps
3. Product → Run (⌘R)

Getting the Panic Log

After the device reboots:

1. Plug into Mac
2. Open Xcode → Window → Devices and Simulators → View Device Logs
3. Find the most recent Panic log (.ips file)
4. Save it to panic-logs/ and commit for analysis

Alternatively via Terminal:

# After reboot, pull the log
idevicecrashreport -u <UDID> ./panic-logs/

What to Look For in the Panic Log

On A18 (iPhone 16e) you should see one of:

• MTE tag check fault — the UAF variant freeing and reallocating a tagged heap object
• AOP watchdog timeout — the AOP variant saturating the SPU mailbox

Key fields to note:

Kernel version:      Darwin Kernel Version ...
Hardware Model:      iPhone17,5
panic(cpu N ...):    <the actual panic string>
Backtrace:
  ... IOHIDEventServiceFastPathUserClient ...

The function names in the backtrace tell you exactly which code path triggered.

Disclosure Timeline

Reporting to Apple

Unpatched variants or related bugs can be reported at: https://security.apple.com/submit

For kernel bugs: describe component, reproduction steps, crash type, and attach the .ips panic log.

Related CVEs on iOS 18.7.1

For educational and responsible disclosure purposes only.