CVE-2026-28982: Apple macOS Race Condition Vulnerability

CVE-2026-28982 Overview

CVE-2026-28982 is a race condition vulnerability in Apple macOS that a remote attacker can exploit to cause unexpected system termination or corrupt kernel memory. The flaw stems from insufficient locking in a kernel code path and is classified under [CWE-362]. Apple addressed the issue with improved locking in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The vulnerability is exploitable over the network without authentication or user interaction, giving it a high impact against confidentiality, integrity, and availability.

Critical Impact
Remote attackers can trigger kernel memory corruption or system crashes on unpatched macOS systems without any user interaction.

Affected Products

Apple macOS Sequoia prior to 15.7.8
Apple macOS Sonoma prior to 14.8.8
Apple macOS Tahoe prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-28982 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-28982

Vulnerability Analysis

The vulnerability is a concurrency defect in a macOS kernel component. Two or more execution threads access a shared resource without adequate synchronization, allowing an attacker to interleave operations in a state the code does not expect. Apple's advisory notes the issue was resolved with improved locking, indicating the original code path lacked a required mutex or held a lock over an insufficient region.

Successful exploitation results in either unexpected system termination (a kernel panic) or kernel memory corruption. Kernel memory corruption on macOS can be leveraged to escalate the impact beyond denial of service, depending on which structures the attacker can influence during the race window.

Root Cause

The root cause is a race condition [CWE-362] in a network-reachable kernel routine. Concurrent access to shared kernel state was not properly serialized, permitting a time-of-check to time-of-use style discrepancy or an unsafe write during another thread's read. Apple's remediation was to widen or add locking to enforce mutual exclusion around the affected critical section.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. A remote user sends crafted traffic to the vulnerable macOS host to trigger the racing kernel paths. Because timing is essential to race condition exploitation, an attacker typically issues repeated or parallel requests to increase the probability of hitting the vulnerable window.

Apple has not published a technical description of the affected component beyond the advisories referenced in Apple Support Article #128067, Apple Support Article #128071, and Apple Support Article #128072. No public proof-of-concept exploit is available at time of writing.

Detection Methods for CVE-2026-28982

Indicators of Compromise

Unexpected kernel panics or reboots on macOS hosts, particularly correlated with inbound network activity
Panic logs in /Library/Logs/DiagnosticReports/ referencing lock contention, kernel memory faults, or the affected subsystem
Repeated or high-volume connection attempts from a single remote source targeting macOS endpoints

Detection Strategies

Inventory macOS hosts and flag any running versions below 15.7.8 (Sequoia), 14.8.8 (Sonoma), or 26.6 (Tahoe)
Monitor endpoint telemetry for repeated unplanned reboots and kernel panic events on macOS assets
Baseline inbound network flows to macOS systems and alert on anomalous connection bursts from untrusted sources

Monitoring Recommendations

Forward macOS system.log, wifi.log, and DiagnosticReports data to a centralized logging platform for correlation
Alert on kernel panic frequency thresholds across the macOS fleet to identify targeted exploitation attempts
Track OS build versions continuously so newly non-compliant hosts are flagged after each Apple release cycle

How to Mitigate CVE-2026-28982

Immediate Actions Required

Update all macOS endpoints to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6
Prioritize patching for macOS hosts exposed to untrusted networks or reachable from the internet
Restrict inbound network access to macOS systems using host and perimeter firewalls until patches are deployed

Patch Information

Apple released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Refer to Apple Support Article #128067, Apple Support Article #128071, and Apple Support Article #128072 for version-specific details and installation guidance. Apply the update via System Settings > General > Software Update, or through your MDM platform.

Workarounds

Apply network segmentation to isolate macOS endpoints from untrusted or internet-facing segments
Use host-based firewall rules to limit which services accept remote connections
Disable non-essential network services on macOS until patches are applied

bash

# Verify current macOS version and check for updates
sw_vers -productVersion
softwareupdate --list
sudo softwareupdate --install --all --restart