Kernel-Panic — PoC Archivehttps://poc.intelseclab.com/tags/kernel-panic/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000XNU PF_ROUTE RTA_GENMASK Heap Buffer Overflow (CVE-2026-20698)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20698-xnu-pf-route-heap-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20698-xnu-pf-route-heap-overflow/High severity — binary · CVE-2026-20698. Status: PoC. Affects: XNU kernel routing socket subsystem (PF_ROUTE, bsd/net/rtsock.c / bsd/net/radix.c). Tags: xnu, kernel, ios, macos, pf_route, routing-socket, heap-overflow, radix-tree, kernel-panic, bounds-safety.binaryHighxnukerneliosmacospf_routerouting-socketheap-overflowradix-treekernel-panicbounds-safetyLinux Kernel ICMP Fragmentation-Needed NULL Pointer Dereference (CVE-2026-23398)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-23398-icmp-frag-needed/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-23398-icmp-frag-needed/High severity — network · CVE-2026-23398. Status: PoC. Affects: Linux kernel, icmp_tag_validation() / icmp_unreach() in net/ipv4/icmp.c. Tags: linux-kernel, icmp, denial-of-service, null-pointer-dereference, kernel-panic, pmtu, scapy, remote-dos.networkHighlinux-kernelicmpdenial-of-servicenull-pointer-dereferencekernel-panicpmtuscapyremote-dosLinux Kernel Futex-PI rtmutex remove_waiter() Use-After-Free (CVE-2026-43499)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/High severity (CVSS 7.8) — binary · CVE-2026-43499. Status: PoC. Affects: Linux kernel — kernel/locking/rtmutex.c, futex-PI subsystem (futex_requeue() / rt_mutex_start_proxy_lock()). Tags: linux-kernel, android, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, kernel-panic, ndk.binaryHighlinux-kernelandroiduse-after-freefutexrtmutexpriority-inheritancelpelocalkernel-panicndkAppleSEPKeyStore IOKit Use-After-Free (CVE-2026-20637)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20637-applesepkeystore-uaf/High severity — binary · CVE-2026-20637. Status: PoC. Affects: AppleSEPKeyStore driver (com.apple.driver.AppleSEPKeyStore, exposed as IOKit service AppleKeyStore). Tags: ios, macos, kernel, iokit, use-after-free, race-condition, aksepkeystore, xnu, kernel-panic.binaryHighiosmacoskerneliokituse-after-freerace-conditionaksepkeystorexnukernel-panicAppleJPEGDriver startDecoder Timeout Use-After-Free (CVE-2026-20687)https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20687-applejpegdriver-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-20687-applejpegdriver-uaf/High severity — binary · CVE-2026-20687. Status: PoC. Affects: AppleJPEGDriver kernel extension. Tags: ios, kernel, applejpegdriver, use-after-free, mte, iokit, kernel-panic, camera.binaryHighioskernelapplejpegdriveruse-after-freemteiokitkernel-paniccamera