Apple’s memory safety layer is built on a simple bet: when a corrupting bug exists, a tag mismatch will make the exploit fail.
A report from security firm Calif shows the bet can be lost. The team chained CVE-2026-64704 and CVE-2026-64699 into the first public macOS kernel exploit on M5 hardware with Memory Integrity Enforcement switched on. It begins as a local user and ends with root. Apple shipped the fixes in macOS 26.6.
Two open-source pieces, one chain
Both bugs live in Apple’s SMB and WebDAV clients, which split their work between an in-kernel filesystem and a userspace helper that talks to the remote server. A malicious server therefore controls the bytes the kernel parses.
In SMBClient the client sends a request tagged Resolve ID, and the reply parser trusts the tag the server echoes back. Name the lease type instead and the kernel reinterprets the request object, reading a caller-supplied inode number as a pointer.
The WebDAV half is an information leak. A stalled download pushes the kernel into fetching bytes directly, but the buffer is never zeroed and is copied back out at the requested length rather than the length received. An empty, ostensibly successful response returns uninitialised kernel memory.
Bruce Dang, Dion Blazakis and Josh Maine found the flaws on April 25 and had a working exploit by May 1.
Since March, Calif says it has reported 38 vulnerabilities to Apple. An earlier M5 bypass from the same firm was credited in an advisory against CVE-2026-28952.
Macs on Golden Gate 27.x are already past 26.6. Anyone still on Tahoe should confirm 26.6 or later.
