FAQ

I have spent the last few days on entirely patch diffing and analysing iOS 27.0.1 alongside 27.2 which patched it. The 27.2 release is actually helpful because along with it came all the CVE vulnerabilities Calif used. I also found an SPTM vulnerability but it isn't usable yet as it needs kernel Read write access. ETA SON?

Chain Summary

WebKit RCE → GPU Process Sandbox Escape → Kernel UAF (IOKit/IOSurface) → SPTM UAT Race (EL2)

---

1. WebKit RCE (Initial Foothold)

- Location: JavaScriptCore / WebKit (among 120+ CVEs in 27.2 security content)

- Status: Exact CVE not isolated due to recompilation noise; diff shows minor bounds checks added

- Impact: Code execution in WebContent process (sandboxed)

---

1. GPU Process Sandbox Escape

- GPU Profile: Allows selector 10 on IOSurfaceRootUserClient (confirmed via sandbox profile diff - IDENTICAL between versions)

- GPU Process Entitlements:

- com.apple.private.gpu.device

- com.apple.private.allow-gpu-replay

- com.apple.private.allow-gpu-hang-recovery

- NO com.apple.security.exception.iokit-user-client-class

- WebContentExtension: Has BlockIOKitInWebContentSandbox - explicitly blocked

- Gap: GPU process lacks IOKit entitlement but may bypass via com.apple.private.gpu.device entitlement for GPU-related user clients (IOMobileGraphics, AGX)

---

1. Kernel r/W via UAF (CRITICAL FINDING)

┌──────────────────────────────┬───────────────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────┐

│ Aspect │ 27.0.1 (Vulnerable) │ 27.2 (Patched) │

├──────────────────────────────┼───────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────┤

│ UAF Function │ 0xfffffff00a78fc80 (480 bytes) │ 0xfffffff00a7d7f40 (2,504 bytes, +2,024 bytes) │

├──────────────────────────────┼───────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────┤

│ Reverse Paths (UAF→IOKit) │ 27 paths │ 1 path │

├──────────────────────────────┼───────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────┤

│ Forward Paths (IOKit→UAF) │ 1 path via 0xfffffff00aeb2db8 (IOUserClient externalMethod) │ 1 path via 0xfffffff00aefec80 (different, depth 12) │

├──────────────────────────────┼───────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────┤

│ IOSurfaceRootUserClient Path │ ✅ Reachable (0xfffffff00ae78540 has "com.apple.iokit.IOSurface") │ ❌ SEVERED │

├──────────────────────────────┼───────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────┤

│ RootDomainUserClient │ Reachable │ Not reachable │

├──────────────────────────────┼───────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────┤

│ DriverKit Clients │ Reachable │ Not reachable │

└──────────────────────────────┴───────────────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────┘

The Patch:

- Added extensive bounds checking to UAF function (+2,024 bytes)

- Severed the call chain from IOSurfaceRootUserClient to the UAF

- Only a generic IOService path remains (not userland-triggerable)

UAF Details:

- Leaf function (no BL/BLR calls)

- Called via PAC-authenticated indirect calls (BLR/BLRAA)

- Likely one of: CVE-2024-65350, CVE-2024-112514, CVE-2024-112517

- Reachable from userland via IOConnectCallMethod on IOSurfaceRootUserClient

---

1. SPTM UAT Race (EL2 Compromise)

- Target: TLB-invalidation race in sapt_update_permissions_uat_unmap_sync / map_sync

- Trigger: GENTER instruction (0x00201420) targeting UAT endpoints

- SPTM Mutation Cluster: 3 guarded functions + 5 helpers (cluster_calls ≥ 3/5)

- GENTER Dispatch Surface: 171 sites, 10 tables, 14 UAT endpoints mapped

- Firmware Patch (27.0.1→27.2): 24 DMB ISH/ISHST, PAC/AUT, AT S1E1R/W concentrated in FUNC_B

---

Reachability from Normal App Process

YES - The UAF is reachable from a normal app:

1. Normal apps CAN access IOSurfaceRootUserClient (no special entitlement)

2. In 27.0.1: IOConnectCallMethod → IOSurfaceRootUserClient → IOUserClient::externalMethod → UAF

3. This gives kernel read/write primitive

What I used as a base for all my research - https://github.com/IvanIVGrozny/iOS27.0.1-SPTM-Research/

Now that 27.2 is released to the public here come all the posts asking if they should update so let’s make this one post with an easy explanation. It’s common sense EVERYTHING and EVERYONE is saying stay on 27.0.1 DO NOT UPDATE TO 27.2 if you want even a chance at a jailbreak.
STAY ON 27.0.1 OR LOWER If you're on IOS 26 its up to you if you want to update but your window is closing
DISABLE UPDATES and SECURITY UPDATES thanks u/Entire_Hand_5444
If you’re on iOS 27.0 or 27.2, including betas, install 27.0.1

CALIF CONFIRMED THEY PATCHED THE METHOD THEY USED IN 27.2

Someone wanted a confirmation.
One Jailbreak on X
GeoSn0w On X
EDIT:
YOU CANNOT DelayOTA ON IOS 27

• iOS 27 limitation: Delayed OTA (Over-The-Air) profiles and update mechanisms are officially unsupported on iOS 27 and later versions.
• How it works instead: If you are on an older version (like iOS 18 or iOS 26), you can sometimes use DelayOTA to move to a newer version like iOS 27.0.1, or you must rely on standard signed firmware updates if you are already running iOS 27.0.

So I wanted to delayota from ios 26.2.1 to ios 27, and I can’t do that.

I don’t have tvOS profile installed nor disable any ota daemon using Nugget or something like that. But, I do have other iPhones which have tvOS profile, and also using the same Apple ID as the iPhone I’m trying to update.

Do I have to remove the tvOS profile on the other iPhones and idk, wait for it to sync in order to update? I appreciate any help, thanks!

CleanCore 1.2 update notes.

1. There was a discrepancy between the battery percentage shown by iOS and the battery percentage displayed on the CleanCore dashboard. This issue has been resolved.
2. Previously, when the CleanCore app was sent to the background and then reopened, it would constantly perform a scan. Now, it will no longer perform a scan unless you completely terminate the CleanCore application.
3. A large widget option has been added alongside the small widget on the iOS home screen. (The refresh process for widgets on the home screen depends entirely on the iOS operating system.)

For those awaiting iOS 26.0.1, testing processes are still underway. Support for iOS 26.0.1 will be added once CleanCore reaches full stability.

Repo: repo.tweakdeveloper.com

its been a great 6 years on my 12 pro max with unc0ver ios 14. but i cannot take it anymore with the broken apps, recent tweaks not working, loss of app support, and glitches overall. you may remember me from my first post in here a couple months ago explaining my frustrations with being on such an outdated ios 😂. this was before the september apple event so, before the new phones were even out.

i wont get rid of the phone but im finally buying a new phone after SIX. YEARS. silver 256gb 18 pro max here i come (which is funny bc im only using 100gb of the 128 on my 12pm).

i will be grieving my tweaks but im ok with losing them if i can still sideload on my new phone. bc tweaked social apps are the number one thing i need (i cannot stand ads and need download media options).

ANOTHER THING I HAVE TO NOTE: my gosh the new ios’s are SO ugly. i absolutely hate the new photos app, the way notifs stack/behave on the lock screen (i cant smoothly swipe to clear them the way i can on ios 14 without it swiping to the camera), and the look of liquid glass is horrid.

i am writing to ask if there is an ios 27 equivalent to a keyboard tweak i have. shortmoji. i have an unjailbroken phone that ive been using for the past year and the biggest pet peeve is the basic plain stock iphone keyboard. like, shortmoji giving me the copy, cut, paste, select all, delete, minimize keyboard buttons is another level of ELITE productivity you dont know till its taken from you.

please let me know!

Is this good and a matter of waiting now ?

Will I be able to get dopamine

Crane / choicy etc app manager muffin store usual apps tweaks eevespotify? Will I have to sign apps every 7 days , what maximum number of apps? Are certificate worth buying ? Or is a live container worth looking at

I supervised my iPhone 13 (17.0) using geranium and delayed ota to 27.0.1 but how do I unsupervise it once I update it to 27.0.1 as I will lose access to trollstore

I woke up today and my 17 has the build number enabled now i never had this before or used cowbunga or anything similar but i did restore from my 14 which did have it but i managed to turn it off some how but i cant remember how and cowbunga deep clean did not help at all please someone tell me how without restoring the phone and updating

I am currently on iOS 18.4.1 - iPhone 14 Pro Max debating whether to update to iOS 27.0.1, however on my settings it says I have the option of going to iOS 26.7.2. If I decide to stay where I am and miraculously a jailbreak gets released I have seen I cannot delayOTA. My question is would I be able to go to 26.7.2 via settings update if that version is supported for jailbreak?

I have an iPhone 6S iOS 15.8.8 32GB, I would like to jailbreak it and I don't want it to expire after 7 days. I want someone who can help me jailbreak my iPhone step by step on Discord because I have difficulty understanding it.

Anyone has any idea how to disable the iOS 27.2 update badge ? It is annoying af for me.

I updated an iPad to 27.0.1 with a restore to an IPSW file. It found the update to 27.2 and is showing it in settings before I could get the DNS update blocker (https://kittymaxine.com/blockota.mobileconfig) installed. How can I get rid of the update/make the device unaware of the update? The update shows under Software Update with a button to install it and I want the button gone. I have other devices I put on 27.0.1 before 27.2 released and the DNS blocker kept the 27.2 from showing, as 27.0.1 was still current at the time of installation.

Hello to all of you!

Im curently on iPhone 17 pro on 27.0.
What is best thing to do right now for upcoming potential jailbreak? Stay on 27.0 or update to 27.0.1 and how to do it because iPhone says its only avaible to update to 27.2. Thanks a lot guys

Hey r/jailbreak, I'm Carter and this is my first ever tweak I'm making public! Ever respring out of nowhere and have no idea which tweak caused it? Mountaineer keeps a crash diary for you and explains it in plain English.

What it does

• Crash diary with a readable Timeline (pull to refresh after a weird respring)
• Tweak fault hints when a dylib looks guilty
• Copy Report: a clean summary to paste into Discord or a dev's bug form, "what happened" first
• App Shield to keep tweaks out of App Store apps, or hide the jailbreak from apps that hate it
• Marks your own resprings as intentional so they don't show up as crashes

Honest limits: it reports what the diary saw. It can't invent a culprit, and it doesn't replace Safe Mode when SpringBoard is actively crashing. App Shield and path hiding are best-effort.

• Price: free
• Works on: iOS 15+, Dopamine rootless (tested mostly on iOS 17.1, iPhone 15 Pro Max)
• Repo: https://tweaks.carterware.net/
• Page: https://tweaks.carterware.net/mountaineer.html

Found a bug? Settings → Mountaineer → Report a Bug fills in your version, iOS and model for you. Feedback very welcome, I'll be in the comments.

Question- due to fakes, Al Slop, etc... it's hard to find true reliable information on jailbreaking, which is why I solely check here for any information. I use YouTube tutorials to do everything because just do [fill in the blank] leaves room for holes. What might be obvious for one person might not for another. Yes, I’ve read the guides here but the hole that doesn’t make sense is… just supervise your device…. Like thanks for leaving out the how to supervise. 🤦🏼‍♀️ Having said that, what is a good YouTube tutorial for delay OTA that is in depth and goes from A to Z how to?

İ am proud to introduce to you TwentyOne v2.1, with lots of quality-of-life improvements and new features:

what's new?

- recreated iOS 27 Artist Pages (with artist custom logos and background tinting)

- [BETA] 3rd party music apps (such as yt music, spotify, etc) can now show animated album cover art in the lock screen

- [BETA] added initial support for iOS 15 (thank you [u/ChemicalArmadillo602](u/ChemicalArmadillo602) for the help)

other fixes/logs:

- added new bugs so that İ can have something to fix in the next release

- the black -> tinted background transition/visual bug in non immersive albums is now fixed

- redesigned settings page

- tweak features (such as background tinting) can now be customized in settings

- added option to enable animated album covers when in Low Power Mode

- added option to completely hide the clock and date when full screen animated album cover is showing in lockscreen

- changed "Listen Now" to "Home"

- technically, the version number is 2.0.4. but for ✨branding✨, its 2.1

recap on TwentyOne features:

- background tinting based on Album Cover Art or Artist Cover Page

- animated Album Cover in Now-Playing Screen

- animated Album Cover in Fullscreen Lockscreen

- native last.fm scrobbling

note for iOS 15 users: please send me logs if you found some issues. it is located in /var/mobile/Media/TwentyOne. some features are unavailable (like the lockscreen and now playing animated cover art)

note for 3rd party music apps: it may take a while to apply the animated album cover in the lockscreen compared to apple music, and some songs will not display the animated album cover (even though it has one in apple music)

donations: while donations are not required, i really appreciate your kindness :3 your gift will help me pay my tuition fees and pay for my lunch ❤ paypal.me/neilbayron

source code is available at https://github.com/pisknk/twenty-one-reborn
grab a copy of TwentyOne at https://pisknk.github.io/repo
or download the debs directly at https://github.com/pisknk/twenty-one-reborn/releases/tag/2.1

Rootless and RootHide archs are supported. Thank you jailbreak community!

I'm on Dopamine 3.0.9 on iOS 17.3.1. Dopamine shows an update for v3.0.12. But unlike for previous updates, hitting the button doesn't start an OTA update process but instead forwards me to the Github page for Dopamine.

Is OTA no longer available, or is there some setting I'm missing? If I need to install the IPA for the update, do I go the full process through Plumeimpactor, as if this was a fresh jailbreak?

Edit: Found the problem - I was still on MacOS 26, but needed 27 to proceed. Kudos to ChatGPT who found a perma-backgrounded "Do you want to update first?" window which I couldn't see and which, for lack of my reaction, wouldn't let the process go ahead. Safely on 27.0.1 now :)

I grabbed an iPhone 18 Pro on 27.0 and am trying to update it to 27.0.1 after 27.2 has come out earlier today. ipsw.me still marks 27.0.1 as signed, so I downloaded it and picked it in the Mac Finder via Alt + "Update" button. I can choose the IPSW file and click "open", but then nothing happens, the file picker just closes. Any clue if I can still use the 27.0.1 file, or has signing stopped despite the ipsw.me confirmation? Thanks!

Right now im on 26.1 and wondering if i should update to 27.0.1 since its still signed