CVE-2026-10635: use-after-free in zephyrproject zephyr
On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of active memory domains using a list node embedded inside the caller-owned struct k_mem_domain. When a domain is destroyed via k_mem_domain_deinit() -> arch_mem_domain_deinit(), the page tables are torn down and domain->arch.ptables is set to NULL, but the domain's node was not removed from xtensa_domain_list. The freed/deinitialized domain therefore remained linked into the global list as a dangling pointer into caller-owned storage that may then be freed or reused. Any subsequent arch_mem_map()/arch_mem_unmap() operation (widely invoked by kernel memory-mapping and demand-paging code) traverses the stale node and dereferences domain->ptables: at minimum a NULL pointer dereference causing a fatal MMU exception (denial of service), and if the k_mem_domain storage has been freed or reused, a use-after-free in which a stale/controlled ptables value is dereferenced and written through during the page-table walk (l2_page_table_map writes l1_table[...] and l2_table[...], and xtensa_mmu_compute_domain_regs writes into the domain struct and the L1 table), yielding page-table memory corruption that can undermine userspace isolation. The vulnerable path is reachable only from privileged kernel/supervisor code (k_mem_domain_deinit is not a syscall), not directly from unprivileged user threads or remotely. Affected: Zephyr v4.4.0 (the Xtensa memory-domain de-initialization feature was introduced in commit 3032b58f52d and first shipped in v4.4.0); fixed on main by adding sys_slist_find_and_remove() in arch_mem_domain_deinit(). The Xtensa MPU path is unaffected.
AI Analysis
Technical Summary
On Xtensa targets with specific configurations, the Zephyr kernel's page-table code maintains a global list of active memory domains. When a memory domain is destroyed, its node is not removed from this list, leaving a dangling pointer. Subsequent kernel memory mapping or unmapping operations traverse this stale node and dereference a NULL or stale pointer, causing a use-after-free condition. This leads to potential page-table memory corruption and undermines userspace isolation. The vulnerability is limited to privileged kernel code paths and was introduced in Zephyr v4.4.0. It has been fixed on the main branch by properly removing the node from the global list during domain de-initialization. The Xtensa MPU path is not affected.
Potential Impact
The vulnerability can cause a denial of service due to a fatal MMU exception from a NULL pointer dereference. More critically, it can lead to use-after-free memory corruption of page tables, potentially undermining userspace isolation. However, exploitation requires privileged kernel access and cannot be triggered directly by unprivileged or remote users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix on the main branch involves removing the stale node from the global list during domain de-initialization. Until an official patch is released, users should avoid configurations that enable this feature or restrict privileged code changes that invoke k_mem_domain_deinit on affected versions.
CVE-2026-10635: use-after-free in zephyrproject zephyr
Description
On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of active memory domains using a list node embedded inside the caller-owned struct k_mem_domain. When a domain is destroyed via k_mem_domain_deinit() -> arch_mem_domain_deinit(), the page tables are torn down and domain->arch.ptables is set to NULL, but the domain's node was not removed from xtensa_domain_list. The freed/deinitialized domain therefore remained linked into the global list as a dangling pointer into caller-owned storage that may then be freed or reused. Any subsequent arch_mem_map()/arch_mem_unmap() operation (widely invoked by kernel memory-mapping and demand-paging code) traverses the stale node and dereferences domain->ptables: at minimum a NULL pointer dereference causing a fatal MMU exception (denial of service), and if the k_mem_domain storage has been freed or reused, a use-after-free in which a stale/controlled ptables value is dereferenced and written through during the page-table walk (l2_page_table_map writes l1_table[...] and l2_table[...], and xtensa_mmu_compute_domain_regs writes into the domain struct and the L1 table), yielding page-table memory corruption that can undermine userspace isolation. The vulnerable path is reachable only from privileged kernel/supervisor code (k_mem_domain_deinit is not a syscall), not directly from unprivileged user threads or remotely. Affected: Zephyr v4.4.0 (the Xtensa memory-domain de-initialization feature was introduced in commit 3032b58f52d and first shipped in v4.4.0); fixed on main by adding sys_slist_find_and_remove() in arch_mem_domain_deinit(). The Xtensa MPU path is unaffected.
CVSS v3.1
Score 6.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
On Xtensa targets with specific configurations, the Zephyr kernel's page-table code maintains a global list of active memory domains. When a memory domain is destroyed, its node is not removed from this list, leaving a dangling pointer. Subsequent kernel memory mapping or unmapping operations traverse this stale node and dereference a NULL or stale pointer, causing a use-after-free condition. This leads to potential page-table memory corruption and undermines userspace isolation. The vulnerability is limited to privileged kernel code paths and was introduced in Zephyr v4.4.0. It has been fixed on the main branch by properly removing the node from the global list during domain de-initialization. The Xtensa MPU path is not affected.
Potential Impact
The vulnerability can cause a denial of service due to a fatal MMU exception from a NULL pointer dereference. More critically, it can lead to use-after-free memory corruption of page tables, potentially undermining userspace isolation. However, exploitation requires privileged kernel access and cannot be triggered directly by unprivileged or remote users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix on the main branch involves removing the stale node from the global list during domain de-initialization. Until an official patch is released, users should avoid configurations that enable this feature or restrict privileged code changes that invoke k_mem_domain_deinit on affected versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:10:51.941Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a30e6730b89be68884f4f52
Added to database: 06/16/2026, 06:00:19 UTC
Last enriched: 07/15/2026, 10:44:50 UTC
Last updated: 08/01/2026, 07:17:58 UTC
Views: 96
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.