# CVE-2026-20698 — XNU Kernel Heap Overflow via PF_ROUTE RTA_GENMASK

## Overview

Heap buffer overflow in XNU's routing socket (`PF_ROUTE`) when processing `RTA_GENMASK` in `route_msg()`. Triggers kernel panic from an unprivileged process with no entitlements.

- **CVE**: CVE-2026-20698 (credited to DARKNAVY)
- **Affected**: iOS < 26.4, macOS < 26.4
- **Patched**: iOS 26.4 (returns `ENOBUFS` instead of processing oversized genmask)
- **Impact**: Kernel panic / denial of service, potential heap corruption
- **Apple Report**: OE110531644254 (independently discovered, closed as already patched)

## Files

- `pf_route_crash.c` — Minimal PoC (triggers kernel panic)
- `variant_probe.c` — Variant analysis across route families
- `family_probe.c` — Family enumeration probe
- `route_26_4_variants.c` — Post-patch variant testing (26.4)
- `genmask_escalate.c` — Escalation attempt analysis
- `variant_26_4_test.m` — iOS app variant test
- `single_family.c` — Single family isolation test
- `APPLE_SUBMISSION.md` — Original Apple Security Bounty submission
- `panic_iphone17_26.3.1.ips` — Kernel panic log from iPhone 17 Pro Max

## Note

This CVE was officially assigned to **DARKNAVY**, who reported it before us. We independently discovered the same vulnerability through kernel source code analysis and binary testing on a real iPhone 17 Pro Max. Our Apple Security Bounty submission (OE110531644254) was closed as the issue was already patched in iOS 26.4.

## Researcher

Somair Ansar (somairansar71@gmail.com)  
Independently discovered, submitted 29/03/2026. Not the original reporter.
