EIP-2026-103365

The writeup details a race condition in macOS XNU's wait_for_namespace_event() function, where a file descriptor is released for userspace but later freed, potentially leading to a use-after-free vulnerability. Exploitation requires root privileges and precise timing to trigger a kernel panic.