EIP-2026-102157

PRE-CVE

Apple iOS Kernel - Use-After-Free due to bad Error Handling in Personas

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-102157. PoCs published by Google Security Research.

AI-analyzed exploit summary This PoC exploits a use-after-free (UaF) vulnerability in the iOS kernel's persona management code by racing persona allocation and deallocation threads, leading to an extra call to persona_put and potential privilege escalation. The exploit targets a race condition in kpersona_alloc_syscall where an invalid userspace pointer causes a copyout failure, allowing an attacker to manipulate kernel memory.

Description

Apple iOS Kernel - Use-After-Free due to bad Error Handling in Personas

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · cdosios
https://www.exploit-db.com/exploits/45652

This PoC exploits a use-after-free (UaF) vulnerability in the iOS kernel's persona management code by racing persona allocation and deallocation threads, leading to an extra call to persona_put and potential privilege escalation. The exploit targets a race condition in kpersona_alloc_syscall where an invalid userspace pointer causes a copyout failure, allowing an attacker to manipulate kernel memory.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: iOS kernel (tested on iOS 11.3.1, likely affects iOS 12 beta)
Auth required
Prerequisites: Root access on the target device · Multi-threading support to race persona allocation/deallocation
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026