CVE-2026-79979: use-after-free in zephyrproject zephyr

The arm64 MMU backend in Zephyr improperly invalidates TLB entries by only targeting ASID 0, which corresponds to kernel page tables and global entries. Memory domains use ASIDs starting at 1, and their non-global cached translations survive this invalidation. During demand paging, when a page frame is evicted and reused, user threads with mappings to that frame retain valid EL0 read/write access, allowing them to read or write supervisor data or other users' memory. This breaks the isolation guarantees of CONFIG_USERSPACE, enabling information disclosure and memory corruption. The fix changes the TLB invalidation to use TLBI VAAE1{IS}, which invalidates all ASIDs and both global and non-global entries, ensuring no stale translations remain. Additionally, the fix prevents globalize_table() from stripping EL0 permissions and non-global attributes during paging synchronization, preserving user thread access to their memory domains.

This vulnerability allows unprivileged user threads to access and modify memory that should be isolated, including kernel data, other memory domains, or other threads' stacks. This defeats the memory isolation enforced by CONFIG_USERSPACE, potentially leading to information disclosure, memory corruption, and full system compromise. The impact is high given the ability to escalate privileges and compromise system integrity.

A fix is available that corrects the TLB invalidation to cover all ASIDs and preserves user memory domain permissions during paging synchronization. Users should upgrade Zephyr to versions 4.5.0 or later where this issue is resolved. Until patched, systems with arm64 builds using CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled and demand-paged private mappings are vulnerable.