Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/somisomair/cve-2026-20698-pf_route-heap-overflow
Vulnerability AnalysisExploitationBinary Analysis
GitHubsomisomair/cve-2026-20698-pf_route-heap-overflow

CVE-2026-20698-PF_ROUTE-Heap-Overflow

CVE-2026-20698: XNU kernel heap overflow via PF_ROUTE RTA_GENMASK. PoC and analysis. Independently discovered.

View Repository
64 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-20698 — XNU Kernel Heap Overflow via PF_ROUTE RTA_GENMASK

Overview

Heap buffer overflow in XNU's routing socket (PF_ROUTE) when processing RTA_GENMASK in route_msg(). Triggers kernel panic from an unprivileged process with no entitlements.

  • CVE: CVE-2026-20698 (credited to DARKNAVY)
  • Affected: iOS < 26.4, macOS < 26.4
  • Patched: iOS 26.4 (returns ENOBUFS instead of processing oversized genmask)
  • Impact: Kernel panic / denial of service, potential heap corruption
  • Apple Report: OE110531644254 (independently discovered, closed as already patched)

Files

  • pf_route_crash.c — Minimal PoC (triggers kernel panic)
  • variant_probe.c — Variant analysis across route families
  • family_probe.c — Family enumeration probe
  • route_26_4_variants.c — Post-patch variant testing (26.4)
  • genmask_escalate.c — Escalation attempt analysis
  • variant_26_4_test.m — iOS app variant test
  • single_family.c — Single family isolation test
  • APPLE_SUBMISSION.md — Original Apple Security Bounty submission
  • panic_iphone17_26.3.1.ips — Kernel panic log from iPhone 17 Pro Max

    • Note

    This CVE was officially assigned to DARKNAVY, who reported it before us. We independently discovered the same vulnerability through kernel source code analysis and binary testing on a real iPhone 17 Pro Max. Our Apple Security Bounty submission (OE110531644254) was closed as the issue was already patched in iOS 26.4.

    Researcher

    Somair Ansar ([email protected])
    Independently discovered, submitted 29/03/2026. Not the original reporter.

    Download Tool