Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init

Summary

CVE	CVE-2026-10635
State	PUBLISHED
Assigner	zephyr
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-06-16 06:16:57 UTC
Updated	2026-06-16 20:52:48 UTC
Description	On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of active memory domains using a list node embedded inside the caller-owned struct k_mem_domain. When a domain is destroyed via k_mem_domain_deinit() - arch_mem_domain_deinit(), the page tables are torn down and domain-arch.ptables is set to NULL, but the domain's node was not removed from xtensa_domain_list. The freed/deinitialized domain therefore remained linked into the global list as a dangling pointer into caller-owned storage that may then be freed or reused. Any subsequent arch_mem_map()/arch_mem_unmap() operation (widely invoked by kernel memory-mapping and demand-paging code) traverses the stale node and dereferences domain-ptables: at minimum a NULL pointer dereference causing a fatal MMU exception (denial of service), and if the k_mem_domain storage has been freed or reused, a use-after-free in which a stale/controlled ptables value is dereferenced and written through during the page-table walk (l2_page_table_map writes l1_table[...] and l2_table[...], and xtensa_mmu_compute_domain_regs writes into the domain struct and the L1 table), yielding page-table memory corruption that can undermine userspace isolation. The vulnerable path is reachable only from privileged kernel/supervisor code (k_mem_domain_deinit is not a syscall), not directly from unprivileged user threads or remotely. Affected: Zephyr v4.4.0 (the Xtensa memory-domain de-initialization feature was introduced in commit 3032b58f52d and first shipped in v4.4.0); fixed on main by adding sys_slist_find_and_remove() in arch_mem_domain_deinit(). The Xtensa MPU path is unaffected.

Risk And Classification

Primary CVSS: v3.1 6.3 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

EPSS: 0.001170000 probability, percentile 0.019440000 (date 2026-06-18)

Problem Types: CWE-416 | CWE-416 use-after-free

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	6.3	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H`
3.1	[email protected]	Secondary	6.3	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H`
3.1	CNA	CVSS	6.3	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H`

CVSS v3.1 Breakdown

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Zephyrproject	Zephyr	4.4.0	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Zephyrproject	Zephyr	affected 4.4.0 4.5.0 semver	Not specified

References

Reference	Source	Link	Tags
github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-39v7-cx8j-...	[email protected]	github.com	Exploit, Patch, Vendor Advisory
github.com/zephyrproject-rtos/zephyr/commit/33d43d09337119fc6084b4ab545f...	[email protected]	github.com	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.