PS5 14.10 jailbreak: Prolapse, already patched in 14.20
By Tgames · · 2 min read
Prolapse targets the kernel of PS5 consoles on 14.00 and 14.10. Announced on October 24, it is not public yet, and Sony closed the hole with firmware 14.20.
Lapse, Relapse, then Prolapse
On October 24, 2026, around 2:15 a.m. (Paris time), researcher Jose Coixao (notnotzecoxao on X) wrote in a few words: Prolapse is coming to 14.00 and 14.10. Coixao then laid out the lineage: Lapse covered firmware up to 10.01, Relapse up to 13.60, and Prolapse would go up to 14.10.
All three exploit the same part of the kernel: the deletion of asynchronous I/O requests, the function aio_multi_delete. It releases a lock before taking back the object it is deleting. In that short window, another thread can free the slot and put an attacker-chosen object in it, which the kernel then frees instead. This is a use-after-free born from a "race" between two threads.
14.20 has already shut the door
Firmware 14.20, released on October 21, adds a generation number to each slot and checks it once the lock is taken back: a reused slot is filtered out before it is freed. According to Coixao, it is "a classic fix" for this kind of bug, and every race technique in aio_multi_delete that worked up to and including 14.10 is dead on 14.20.
So Sony fixed the hole before it was even announced. In our article on 14.20, we did not know what it closed: it is now a little clearer.
What Prolapse does not do yet
What should you do with your PS5?
Sources: Jose Coixao's announcement (X) · iXBT.games · Notebookcheck
Lapse, Relapse, then Prolapse
On October 24, 2026, around 2:15 a.m. (Paris time), researcher Jose Coixao (notnotzecoxao on X) wrote in a few words: Prolapse is coming to 14.00 and 14.10. Coixao then laid out the lineage: Lapse covered firmware up to 10.01, Relapse up to 13.60, and Prolapse would go up to 14.10.
All three exploit the same part of the kernel: the deletion of asynchronous I/O requests, the function aio_multi_delete. It releases a lock before taking back the object it is deleting. In that short window, another thread can free the slot and put an attacker-chosen object in it, which the kernel then frees instead. This is a use-after-free born from a "race" between two threads.
14.20 has already shut the door
Firmware 14.20, released on October 21, adds a generation number to each slot and checks it once the lock is taken back: a reused slot is filtered out before it is freed. According to Coixao, it is "a classic fix" for this kind of bug, and every race technique in aio_multi_delete that worked up to and including 14.10 is dead on 14.20.
So Sony fixed the hole before it was even announced. In our article on 14.20, we did not know what it closed: it is now a little clearer.
What Prolapse does not do yet
- No release date: Coixao gave none, and no public demo shows full kernel read and write access yet.
- No game backups: the hypervisor has to be bypassed too. Byepervisor Reborn only works on 13.20 and 13.60; its authors think it "could" work on 14.00 and 14.10, provided there is a kernel exploit. Prolapse would be exactly that missing piece.
- No GTA VI on November 19: nothing guarantees a complete solution will be ready by then, and the game might require a firmware newer than 14.10.
- It is not Gezine's exploit: theirs, shown on 14.10, is separate work, and it remains private.
What should you do with your PS5?
- On 13.60 or lower: do not update anything, Relapse already works.
- On 14.00 or 14.10: if you care about jailbreaking, do not install 14.20; Coixao even advises not going past 14.00. The price to pay: PSN, which already requires 14.10 (our article) and will sooner or later require 14.20.
- On 14.20: Prolapse no longer concerns you.
Sources: Jose Coixao's announcement (X) · iXBT.games · Notebookcheck
No comments