CVE-2026-65330 — tmpfs setxattr PAC Bypass

Component: XNU VFS — default_setxattr_doubleagent (tmpfs VNOP)
Affected: iOS / iPadOS 26.6 (23G71) and earlier
Fixed in: iOS / iPadOS 26.6.1 (23G83)
Type: Fixed PAC diversifier in xattr handler pointer signing
Impact: PC control from kernel context; full privilege escalation when combined with a kernel write primitive

Credits

Discovered by: Bhaswanth Chigurupati, Billy Jheng Bing Jhong, Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
(per Apple Security Advisory — iOS 26.6.1)

Root Cause

default_setxattr_doubleagent, the VNOP xattr handler for the tmpfs filesystem, signs the xattr handler function pointer using a fixed, compile-time constant PAC diversifier: #0x307a.

; XNU kernel — default_setxattr_doubleagent (decompiled)
handler_ptr = vnode_operations[VNOP_SETXATTR_SLOT];   // read from vnop table
signed_ptr  = PACDA(handler_ptr, 0x307a);             // sign with FIXED diversifier
... call AUTDA(signed_ptr, 0x307a) → BLR             // authenticate and branch

Because the diversifier is fixed and publicly known, an attacker with a kernel write primitive can:

1. Forge a PAC-signed pointer to an arbitrary kernel address:
   forged = PACIA(shellcode_addr, 0x307a)
2. Write forged into the appropriate slot of the target vnode's vnode_operations table.
3. Call setxattr() on any file on the tmpfs mount → kernel executes shellcode_addr.

Exploit Chain Role

In the iOS 26.6 kernel privilege escalation chain:

CVE-2026-64788 (IOGPUFamily UAF)  →  kernel r/w primitive
CVE-2026-65330 (this bug)         →  PC control → root (uid=0)

The sign_ptr primitive (PACIA with diversifier #0x307a) is implemented in the jailbreak POC using inline ARM64e assembly. The kernel r/w primitive is used to:

1. Locate the target vnode's v_op pointer.
2. Write the forged PAC pointer into vnode_operations[VNOP_SETXATTR_SLOT].
3. Trigger execution via setxattr("/tmp/trigger", ...).

PoC Behaviour

The standalone PoC (poc_pac_bypass.c) exercises the vulnerable VNOP path:

• Creates a test file at /private/tmp/poc65330_xattr_test (tmpfs — required to hit default_setxattr_doubleagent)
• Calls setxattr() with XATTR_NAME="com.apple.poc.cve65330.test" → hits default_setxattr_doubleagent
• Runs a 10-iteration stress pass to confirm the VNOP is exercised repeatedly
• Calls removexattr() to hit the cleanup path
• Cleans up the test file

The PoC does not forge a PAC pointer or overwrite any kernel data — it only demonstrates that the vulnerable #0x307a signing path is reachable from userspace via a normal setxattr() syscall.

Requirements

• iOS 26.6 (23G71) or earlier
• /private/tmp write access (world-writable tmpfs; no special entitlements required)
• The file must be on a tmpfs mount — default_setxattr_doubleagent is the VFS fallback handler for filesystems without native xattr support (tmpfs, FAT). APFS handles xattrs natively and bypasses this code path entirely.
• Kernel write primitive required for full PC-control exploitation

Build

# Standalone C binary (no frameworks needed)
clang -arch arm64 -o poc poc/poc_pac_bypass.c

# For on-device (with signing):
clang -arch arm64 -isysroot $(xcrun --sdk iphoneos --show-sdk-path) \
      -o poc poc/poc_pac_bypass.c
codesign -s "Apple Development" poc

Diversifier Verification

The fixed diversifier 0x307a was verified from disassembly of the 26.6 (23G71) kernelcache:

; default_setxattr_doubleagent + 0x?? (approximate)
MOVZ  x1, #0x307a          ; diversifier constant
PACIA x0, x1               ; sign handler pointer (instruction key A)

The corresponding AUTIA x0, x1 at the call site uses the same constant, confirming that any PACIA-forged pointer with diversifier 0x307a authenticates successfully.

Timeline

References

• Apple Security Advisory — iOS 26.6.1