## https://sploitus.com/exploit?id=A2EF0CFA-E69E-52E3-9849-7732924E94FE
# CVE-2026-65330 — tmpfs setxattr PAC Bypass
**Component:** XNU VFS — `default_setxattr_doubleagent` (tmpfs VNOP)
**Affected:** iOS / iPadOS 26.6 (23G71) and earlier
**Fixed in:** iOS / iPadOS 26.6.1 (23G83)
**Type:** Fixed PAC diversifier in xattr handler pointer signing
**Impact:** PC control from kernel context; full privilege escalation when combined with a kernel write primitive
---
## Credits
Discovered by: **Bhaswanth Chigurupati**, **Billy Jheng Bing Jhong**, **Pan Zhenpeng (@Peterpan0927)** of STAR Labs SG Pte. Ltd.
(per [Apple Security Advisory — iOS 26.6.1](https://support.apple.com/en-us/148282))
---
## Root Cause
`default_setxattr_doubleagent`, the VNOP xattr handler for the tmpfs filesystem, signs the xattr handler function pointer using a **fixed, compile-time constant PAC diversifier: `#0x307a`**.
```
; XNU kernel — default_setxattr_doubleagent (decompiled)
handler_ptr = vnode_operations[VNOP_SETXATTR_SLOT]; // read from vnop table
signed_ptr = PACDA(handler_ptr, 0x307a); // sign with FIXED diversifier
... call AUTDA(signed_ptr, 0x307a) → BLR // authenticate and branch
```
Because the diversifier is fixed and publicly known, an attacker with a kernel write primitive can:
1. Forge a PAC-signed pointer to an arbitrary kernel address:
`forged = PACIA(shellcode_addr, 0x307a)`
2. Write `forged` into the appropriate slot of the target vnode's `vnode_operations` table.
3. Call `setxattr()` on any file on the tmpfs mount → kernel executes `shellcode_addr`.
---
## Exploit Chain Role
In the iOS 26.6 kernel privilege escalation chain:
```
CVE-2026-64788 (IOGPUFamily UAF) → kernel r/w primitive
CVE-2026-65330 (this bug) → PC control → root (uid=0)
```
The `sign_ptr` primitive (PACIA with diversifier `#0x307a`) is implemented in the jailbreak POC using inline ARM64e assembly. The kernel r/w primitive is used to:
1. Locate the target vnode's `v_op` pointer.
2. Write the forged PAC pointer into `vnode_operations[VNOP_SETXATTR_SLOT]`.
3. Trigger execution via `setxattr("/tmp/trigger", ...)`.
---
## PoC Behaviour
The standalone PoC (`poc_pac_bypass.c`) exercises the vulnerable VNOP path:
- Creates a test file at `/var/root/poc65330_test`
- Calls `setxattr()` with `XATTR_NAME="com.apple.poc.cve65330.test"` → hits `default_setxattr_doubleagent`
- Runs a 10-iteration stress pass to confirm the VNOP is exercised repeatedly
- Calls `removexattr()` to hit the cleanup path
- Cleans up the test file
The PoC does **not** forge a PAC pointer or overwrite any kernel data — it only demonstrates that the vulnerable `#0x307a` signing path is reachable from userspace via a normal `setxattr()` syscall.
---
## Requirements
- iOS 26.6 (23G71) or earlier
- Jailbroken or out-of-sandbox for `/var/root/` file creation (the `setxattr` call itself is reachable from any process — the file path can be adjusted to a sandbox-writable location)
- Kernel write primitive required for full PC-control exploitation
---
## Build
```sh
# Standalone C binary (no frameworks needed)
clang -arch arm64 -o poc poc/poc_pac_bypass.c
# For on-device (with signing):
clang -arch arm64 -isysroot $(xcrun --sdk iphoneos --show-sdk-path) \
-o poc poc/poc_pac_bypass.c
codesign -s "Apple Development" poc
```
---
## Diversifier Verification
The fixed diversifier `0x307a` was verified from disassembly of the 26.6 (23G71) kernelcache:
```
; default_setxattr_doubleagent + 0x?? (approximate)
MOVZ x1, #0x307a ; diversifier constant
PACDA x0, x1 ; sign handler pointer
```
The corresponding `AUTDA x0, x1` at the call site uses the same constant, confirming that any PACIA-forged pointer with diversifier `0x307a` authenticates successfully.
---
## Timeline
| Date | Event |
|------|-------|
| 2026-08-17 | iOS 26.6.1 released with fix |
| 2026-08-17 | Apple credits published in security advisory |
---
## References
- [Apple Security Advisory — iOS 26.6.1](https://support.apple.com/en-us/148282)