{"id":"CVE-2026-10635","revision":"5630474f61984772a161286eeac410aa","records":[{"revision":"5630474f61984772a161286eeac410aa","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-10635","aliases":[],"title":"Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init","description":"On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of active memory domains using a list node embedded inside the caller-owned struct k_mem_domain. When a domain is destroyed via k_mem_domain_deinit() -> arch_mem_domain_deinit(), the page tables are torn down and domain->arch.ptables is set to NULL, but the domain's node was not removed from xtensa_domain_list. The freed/deinitialized domain therefore remained linked into the global list as a dangling pointer into caller-owned storage that may then be freed or reused.\n\nAny subsequent arch_mem_map()/arch_mem_unmap() operation (widely invoked by kernel memory-mapping and demand-paging code) traverses the stale node and dereferences domain->ptables: at minimum a NULL pointer dereference causing a fatal MMU exception (denial of service), and if the k_mem_domain storage has been freed or reused, a use-after-free in which a stale/controlled ptables value is dereferenced and written through during the page-table walk (l2_page_table_map writes l1_table[...] and l2_table[...], and xtensa_mmu_compute_domain_regs writes into the domain struct and the L1 table), yielding page-table memory corruption that can undermine userspace isolation.\n\nThe vulnerable path is reachable only from privileged kernel/supervisor code (k_mem_domain_deinit is not a syscall), not directly from unprivileged user threads or remotely. Affected: Zephyr v4.4.0 (the Xtensa memory-domain de-initialization feature was introduced in commit 3032b58f52d and first shipped in v4.4.0); fixed on main by adding sys_slist_find_and_remove() in arch_mem_domain_deinit(). The Xtensa MPU path is unaffected.","state":0,"publishedAt":"2026-06-16T05:19:20.487+00:00","modifiedAt":"2026-10-15T22:10:00.085+00:00","affected":[{"ecosystem":"https://github.com/zephyrproject-rtos/zephyr","name":"zephyr","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://github.com/zephyrproject-rtos/zephyr\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"zephyr\",\n                    \"product\": \"zephyr\",\n                    \"programFiles\": [\n                        \"arch/xtensa/core/ptables.c\"\n                    ],\n                    \"vendor\": \"zephyrproject\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"4.4.2\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.4.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/33d43d09337119fc6084b4ab545f9267839973f6","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-39v7-cx8j-gq82"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-10635","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-10635","identifiers":["CVE-2026-10635"]},"retained":false,"historicalAffected":[]}],"coverage":[]}