IOGPUFamily Memory Corruption via Crafted Web Content

This is a small standalone Objective-C proof-of-concept repository containing an MIT license, a technical README, and one source file, poc/poc_iogpu_uaf.m. It targets CVE-2026-64788, a use-after-free in IOGPUDevice::create_resource_iosurface in Apple’s IOGPUFamily kernel extension on iOS/iPadOS 26.6 and earlier. The stated flaw occurs when crafted IOSurface dimensions overflow after an IOGPUSysMemory object has been inserted into a GPU resource table, leaving the table with a dangling pointer. The PoC creates an IOSurface-backed Metal texture with overflow-oriented dimensions, interposes Metal stride validation and abort handling so the malformed dimensions reach the GPU daemon/kernel path, finds a GPU resource connection, and uses IOConnectTrap2 to interact with resource operations. It then allocates 300 Metal shared buffers sized to reclaim the freed approximately 0x100-byte/kalloc.256 object slot. A subsequent set_resource_purgeable operation on the stale resource ID distinguishes an absent resource (0xe00002c2) from the stale, sprayed entry being processed (0xe0002be). The source intentionally uses a non-destructive spray: fields at offsets used by later dereferences are set to zero, so only the initial atomic decrement is exercised and potentially dangerous follow-on call paths are skipped. The README explicitly notes that iOS 26 zone sequestration prevents this technique alone from becoming a kernel read/write primitive. Thus, the repository is a credible UAF trigger and confirmation PoC, not a complete privilege-escalation or kernel-execution exploit.

This is a small standalone repository containing an MIT license, a technical README, and one Objective-C proof-of-concept source file, poc/poc_iogpu_uaf.m. It is not a Metasploit, Nuclei, or other exploit-framework module. The PoC targets CVE-2026-64788, described as a use-after-free in Apple IOGPUFamily's IOGPUDevice::create_resource_iosurface on iOS/iPadOS 26.6 and earlier, fixed in 26.6.1. It uses Metal's newTextureWithDescriptor:iosurface:plane: path with crafted dimensions to reach a GPU-daemon/XPC kernel path that registers an IOGPUSysMemory object and then takes an overflow error path without clearing the resource-table entry. The code resolves IOConnectTrap2 dynamically, obtains a GPU resource connection, scans for baseline behavior, plants the stale resource, allocates a configurable spray of shared Metal buffers, and calls the resource-purgeable operation to test the dangling ID. It interposes Metal stride validation and abort handling and installs a SIGTRAP handler so malformed dimensions can proceed rather than terminating the app. The demonstrated primitive is deliberately constrained to safe heap-field values and reports evidence of controlled stale-memory processing. Repository documentation explicitly notes that iOS 26 zone sequestration and still-live external object references prevent this path alone from becoming a kernel read/write primitive; therefore this is a UAF-confirmation PoC rather than a complete privilege-escalation exploit.