{"id":"CVE-2026-10635","summary":"Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init","details":"On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of active memory domains using a list node embedded inside the caller-owned struct k_mem_domain. When a domain is destroyed via k_mem_domain_deinit() -\u003e arch_mem_domain_deinit(), the page tables are torn down and domain-\u003earch.ptables is set to NULL, but the domain's node was not removed from xtensa_domain_list. The freed/deinitialized domain therefore remained linked into the global list as a dangling pointer into caller-owned storage that may then be freed or reused.\n\nAny subsequent arch_mem_map()/arch_mem_unmap() operation (widely invoked by kernel memory-mapping and demand-paging code) traverses the stale node and dereferences domain-\u003eptables: at minimum a NULL pointer dereference causing a fatal MMU exception (denial of service), and if the k_mem_domain storage has been freed or reused, a use-after-free in which a stale/controlled ptables value is dereferenced and written through during the page-table walk (l2_page_table_map writes l1_table[...] and l2_table[...], and xtensa_mmu_compute_domain_regs writes into the domain struct and the L1 table), yielding page-table memory corruption that can undermine userspace isolation.\n\nThe vulnerable path is reachable only from privileged kernel/supervisor code (k_mem_domain_deinit is not a syscall), not directly from unprivileged user threads or remotely. Affected: Zephyr v4.4.0 (the Xtensa memory-domain de-initialization feature was introduced in commit 3032b58f52d and first shipped in v4.4.0); fixed on main by adding sys_slist_find_and_remove() in arch_mem_domain_deinit(). The Xtensa MPU path is unaffected.","aliases":["GHSA-39v7-cx8j-gq82"],"modified":"2026-10-28T10:46:00.095112525Z","published":"2026-06-16T05:19:20.487Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10635.json","cna_assigner":"zephyr","cwe_ids":["CWE-416"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10635.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-39v7-cx8j-gq82"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10635"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/33d43d09337119fc6084b4ab545f9267839973f6"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"684c9e8f32e4373a21098559f748f06915f950c9"},{"fixed":"dccb09599635bdff17633fa7e9dab014b91dce90"},{"fixed":"33d43d09337119fc6084b4ab545f9267839973f6"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"4.4.0"},{"fixed":"4.4.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"33d43d09337119fc6084b4ab545f9267839973f6"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v4.4.2-rc1","v4.4.1","v4.4.1-rc1","v4.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10635.json","vanir_signatures":[{"deprecated":false,"digest":{"length":675,"function_hash":"337781303718374156513501422047620354620"},"id":"CVE-2026-10635-8b157c8c","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/33d43d09337119fc6084b4ab545f9267839973f6","target":{"function":"arch_mem_domain_deinit","file":"arch/xtensa/core/ptables.c"}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/33d43d09337119fc6084b4ab545f9267839973f6","target":{"file":"arch/xtensa/core/ptables.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146314318282395383369079198896444584889","272482401299879855491345827799043448445","137244273375491263035031282840968652453"]},"id":"CVE-2026-10635-8f99c764","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-28T10:46:00Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H"}]}