# Sony PS5 'Relapse' Jailbreak Exploit Chains JSC Memory Corruption and Kernel UAF (aio_multi_wait) on Firmware 7.00-13.60

> A public two-stage exploit named Relapse targets PS5 and PS5 Pro firmware 7.00 through 13.60, chaining a JavaScriptCore memory corruption (structured-clone object-pool mismatch) with a kernel use-after-free race in aio_multi_wait to gain kernel read/write and load unsigned ELF payloads. The PoC is MIT-licensed on GitHub, unreliable (stalls, hangs, panics) and tethered. No CVE, CVSS or in-the-wild exploitation is reported.

- **Published:** 2026-10-02T00:00:00Z
- **Last reviewed:** 2026-10-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2841
- **ID:** TL-2026-2841
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Relapse is a publicly released, browser-delivered, two-stage exploit chain for Sony PlayStation 5 and PS5 Pro consoles running system software 7.00 through 13.60 (14.00 and later are excluded). It was published on GitHub by ntfargo (repository ntfargo/Relapse-Exploit, MIT licence) and reported by GBHackers on 2026-10-02.

Stage 1 (browser / WebKit): the exploit abuses JavaScriptCore (JSC) information leaks together with a structured-clone object-pool mismatch to corrupt a TypedArray, giving out-of-bounds memory access and arbitrary read/write primitives beyond the normal JavaScript sandbox boundaries. The user must load the exploit page (index.html, served by serve.py) in the console's web browser. Per the README, the WebKit stage may need several attempts and the page should be reloaded if the browser stalls.

Stage 2 (kernel): the exploit uses an address leak plus a use-after-free race condition around the aio_multi_wait asynchronous I/O syscall path in the FreeBSD-based kernel. By racing asynchronous I/O handling and reusing freed memory under controlled conditions, it obtains kernel read/write. On success the chain exposes an ELF loader listening on TCP port 9021, allowing unsigned ELF payloads (default payloads are generated into the payloads/ directory) to be sent to the console.

Operational characteristics: the chain is described by its authors as not fully reliable; failures can produce browser stalls, kernel hangs or panics that require a reboot. It is tethered, so it must be re-run after every reboot. The README states it is for educational and security research only. Credits per the sources: Sonic_Iso (kernel exploit), Jordy (WebKit exploit and kernel bug identification), ntfargo and ufm42 (development), Dr. Yenyen (testing). A separate report (GamerGen/GameGPU) dated around 2026-09-14 describes a PS5 kernel use-after-free affecting firmware up to 13.60 and notes that a full chain also needs a user-space entry point, which Relapse supplies via its JSC stage.

No CVE identifier, CVSS score, vendor advisory or in-the-wild malicious exploitation is reported in the sources; the impact is chiefly on console integrity (unsigned code execution, bypass of platform code-signing) rather than a broad enterprise risk. Sony's general guidance is to keep consoles on the latest system software, noting updates may be irreversible and affect legacy compatibility.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1106 Native API

## Sources

- [Sony PS5 Relapse Jailbreak Exploit Uses JSC Memory Corruption and Kernel UAF (GBHackers)](https://gbhackers.com/sony-ps5-relapse-jailbreak-exploit-uses/)
- [ntfargo/Relapse-Exploit - public PoC repository](https://github.com/ntfargo/Relapse-Exploit)
- [New PS5 operating system kernel flaw affects firmware up to 13.60 (GameGPU)](https://en.gamegpu.com/news/zhelezo/novaya-bresh-v-yadre-operatsionnoj-sistemy-ps5-zatronula-proshivki-vplot-do-13-60)
- [PlayStation 5 jailbreak for older firmware released (XDA Developers) - 2022 WebKit-based precedent on firmware 4.03](https://www.xda-developers.com/playstation-5-jailbreak-released-older-firmware/)
- [Relapse-Exploit repository owner profile (ntfargo)](https://github.com/ntfargo)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2841