AppleM2ScalerCSCDriver Shared Scheduler Use-After-Free (CVE-2026-43655)

Metadata

Affected Target

Summary

CVE-2026-43655 is a use-after-free in the AppleM2ScalerCSCDriver kernel driver’s shared scaler-operation scheduler, reachable from a default-sandboxed iOS/iPadOS/macOS app with no special entitlements (only get-task-allow, no jailbreak or private entitlements). A process can submit asynchronous scaler operations, close the IOSurfaceAcceleratorClient connection that owns them, and leave stale entries in the driver-global scheduler state; a later scheduler pass then reads/writes through pointers into memory that has since been freed and reused by other (spray) connections. The PoC proves the UAF by planting a distinct marker value on the victim connection (0xDEAD0001), closing it, reallocating the freed slots via 50 “spray” connections tagged 0xBEEF0002, and showing the crash register (x9) later observed the spray marker instead of the victim marker — proof the scheduler dereferenced freed-and-reused kernel memory.

Vulnerability Details

Root Cause

AppleM2ScalerCSCDriver maintains scheduler state shared across all scaler clients. When a client’s IOSurfaceAcceleratorClient connection is closed (IOServiceClose), the per-client operation storage is freed, but the shared scheduler heap is not fully purged of pending entries belonging to that closed client. A later scheduler pass can then read and write through these stale pointers into memory that has since been reallocated to different (unrelated) connections. Specific offsets observed to be touched through the stale pointer include operation + 0xc94 (credit/marker read), operation + 0xc1c (credit accounting write), and operation + 0x1fe4 (scheduler state/flag write).

Attack Vector

1. App opens a victim AppleM2ScalerCSCDriver connection and creates source/destination IOSurface objects.
2. App submits a synchronous baseline scaler operation, then sets a marker value (0xDEAD0001) via selector 10 on the victim connection.
3. App submits 50 asynchronous scaler operations on the victim connection.
4. App closes the victim connection (IOServiceClose), freeing the victim’s operation objects while stale scheduler entries referencing them remain.
5. App opens 50 “spray” connections, sets their marker to 0xBEEF0002, and submits additional async operations so the freed operation-pool slots get reused by the spray connections.
6. A subsequent scheduler cycle (in practice triggered by SpringBoard/compositor activity, e.g. interacting with the Dynamic Island) processes the stale victim scheduler entry, which now points at memory owned by a spray connection — the observed marker is 0xBEEF0002, not 0xDEAD0001, proving the read/write happened after free-and-reuse.

Impact

Kernel-memory read of freed/reused driver memory and kernel writes to fixed offsets within that reused memory during scheduler accounting. Because the scheduler heap is shared across all scaler clients, the bug has cross-connection and cross-process impact — the ultimate trigger can be driven by unrelated system activity after the original PoC process has exited. Per Apple’s advisory, impact is “an app may be able to cause unexpected system termination or read kernel memory” (kernel panic / info leak primitive; a strong building block for further kernel exploitation).

Environment / Lab Setup

Target:      iOS 26.4 (or earlier) physical device with AppleM2ScalerCSCDriver
Attacker:    Local sideloaded app (get-task-allow entitlement only, no jailbreak)
Build tools: Xcode toolchain / xcrun clang, ldid for ad-hoc signing

Proof of Concept

PoC Script

See ScalerTeardownUAF.m (source), entitlements.plist (minimal get-task-allow entitlement), and ScalerTeardownUAF.ipa (prebuilt IPA) in this folder.

1
2
3
4
5
6
7
8

xcrun -sdk iphoneos clang -framework Foundation -framework UIKit -framework IOKit \
  -framework IOSurface -isysroot $(xcrun --sdk iphoneos --show-sdk-path) \
  -arch arm64 -arch arm64e -miphoneos-version-min=16.0 -fobjc-arc \
  -o iPhoneProbe.app/iPhoneProbe ScalerTeardownUAF.m
ldid -S entitlements.plist iPhoneProbe.app/iPhoneProbe
mkdir -p /tmp/pkg/Payload
cp -r iPhoneProbe.app /tmp/pkg/Payload/
cd /tmp/pkg && zip -qr ScalerTeardownUAF.ipa Payload

Install the resulting IPA (or the prebuilt one) on an affected device, reboot, launch it, tap “TEARDOWN UAF”, then interact with the Dynamic Island to drive the next scaler scheduler cycle. On vulnerable devices this leads to a kernel panic/reboot; inspecting the panic log should show x9 = 0x00000000BEEF0002, confirming the scheduler dereferenced freed-and-reused memory.

Detection & Indicators of Compromise

Signs of compromise:

• Unexplained device panics/reboots shortly after launching an untrusted sideloaded app.
• Panic logs mentioning AppleM2ScalerCSCDriver or IOSurfaceAccelerator in the crashing thread’s backtrace.
• Apps requesting only minimal entitlements (get-task-allow) but performing rapid IOSurfaceAccelerator connection churn.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Somisomair/CVE-2026-43655-AppleM2ScalerCSCDriver-UAF on 2026-07-05.