External risk intelligence

macOS Kernel Race Condition Allows System Termination and Kernel Memory Corruption.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-28982

This vulnerability affects the kernel of the macOS operating system. Kernel-level vulnerabilities are generally not directly reachable from the public internet in standard deployments, as they require local execution or are protected by multiple layers of the operating system's security architecture.

Apple Macos

14.0 to before 14.8.815.0 to before 15.7.826.0 to before 26.6

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in macOS that could allow a remote attacker to cause system instability or memory corruption. While the direct exploitability via the network is considered unlikely in typical deployments, the severity of the potential impact warrants awareness.

Race condition in operating system kernel.
Could lead to system instability or memory corruption.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a race condition in the macOS kernel to cause a system crash or corrupt memory. This vulnerability is accessible over the network and does not require any special privileges or user interaction to trigger. If exploited, it could lead to significant system instability and data integrity issues.

Network access is required.
Triggered by a race condition.
Potential for system termination or memory corruption.

Live Threat

Current exploitation, exposure, and threat context

A race condition in macOS could allow a remote attacker to cause unexpected system termination or corrupt kernel memory. This occurs when specific, though unsupported by this advisory, conditions allow for a remote user to trigger the vulnerability.

Kernel memory and system stability.
Race condition exploited by remote user.
Unexpected system termination.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in macOS kernel memory requires immediate attention from infrastructure and platform teams. The first step is to identify all macOS systems, confirm their reachability and business criticality, and then locate the accountable system owner to plan remediation.

Infrastructure and platform teams own remediation.
Verify system reachability and criticality first.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the macOS kernel affected by CVE-2026-28982?

The kernel is the core foundation of the macOS operating system, acting as the primary bridge between hardware and software. It manages critical tasks like memory allocation, process scheduling, and device communication. When a flaw exists here, it can affect the overall stability and security of the entire machine, as the kernel operates with the highest level of privileges on the system.

How does a race condition cause this vulnerability?

CVE-2026-28982 involves a CWE-362 weakness, where the system performs operations in an incorrect sequence. A race condition occurs when multiple processes try to access or change shared data simultaneously, and the outcome depends on the timing of these events. If the system fails to lock this data properly, it creates a window where an attacker can manipulate memory or force the system to terminate unexpectedly.

Does this vulnerability require user interaction to trigger?

No, this issue does not rely on a user clicking a link or opening a file. Because it involves the kernel's handling of network-based requests, the vulnerability can be triggered remotely. However, simple network traffic is not enough; the attacker must be able to send specifically crafted packets that hit the vulnerable code path while the system is in a race-prone state.

How relevant is this threat to my internet-facing systems?

While the vulnerability is network-accessible, Halo Surface Signal notes it is very unlikely to be reachable from the public internet in standard deployments. The macOS kernel is deeply protected by multiple security layers, and most network-facing services do not provide the direct, low-level access needed to reach this specific kernel code. It is primarily a concern for systems where kernel-level interfaces are exposed.

What is the first step to address CVE-2026-28982?

Your priority is to identify all macOS devices in your environment, specifically those running macOS Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6, which contain the fix. Once identified, verify their business criticality and network reachability to determine the urgency of your update schedule. Coordinate with system owners to ensure these patches are applied as part of your standard maintenance lifecycle.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.