CVE-2026-20698 — XNU Kernel Heap Overflow via PF_ROUTE RTA_GENMASK

Overview

Heap buffer overflow in XNU's routing socket (PF_ROUTE) when processing RTA_GENMASK in route_msg(). Triggers kernel panic from an unprivileged process with no entitlements.

• CVE: CVE-2026-20698 (credited to DARKNAVY)
• Affected: iOS < 26.4, macOS < 26.4
• Patched: iOS 26.4 (returns ENOBUFS instead of processing oversized genmask)
• Impact: Kernel panic / denial of service, potential heap corruption
• Apple Report: OE110531644254 (independently discovered, closed as already patched)

Files

• pf_route_crash.c — Minimal PoC (triggers kernel panic)
• variant_probe.c — Variant analysis across route families
• family_probe.c — Family enumeration probe
• route_26_4_variants.c — Post-patch variant testing (26.4)
• genmask_escalate.c — Escalation attempt analysis
• variant_26_4_test.m — iOS app variant test
• single_family.c — Single family isolation test
• APPLE_SUBMISSION.md — Original Apple Security Bounty submission
• panic_iphone17_26.3.1.ips — Kernel panic log from iPhone 17 Pro Max

Note

This CVE was officially assigned to DARKNAVY, who reported it before us. We independently discovered the same vulnerability through kernel source code analysis and binary testing on a real iPhone 17 Pro Max. Our Apple Security Bounty submission (OE110531644254) was closed as the issue was already patched in iOS 26.4.

Researcher

Somair Ansar ([email protected])
Independently discovered, submitted 29/03/2026. Not the original reporter.