CVE-2026-79979

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The arm64 MMU backend incorrectly handles TLB invalidation within the invalidate tlb page() function in arch/arm64/core/mmu.c. The function uses an operand that only matches ASID 0 (kernel page tables) and global entries, failing to invalidate translations for memory domains that use ASIDs starting at 1. In demand-paging paths, when the eviction algorithm reclaims a frame via page frame prepare locked() and arch mem page out(), the kernel flushes only ASID 0. If a user thread has already accessed the evicted page—such as a k mem partition added via arch mem domain partition add() or a stack mapped by map thread stack()—it retains a valid read/write translation to that physical frame.

An unprivileged user thread can force memory eviction to maintain access to a stale address, allowing read and write access to subsequent data placed in that frame, including supervisor data, other memory domain partitions, or other threads' stacks. This bypasses the isolation provided by CONFIG USERSPACE, potentially leading to information disclosure, memory corruption, and full system compromise. This issue affects arm64 builds with both CONFIG USERSPACE and CONFIG DEMAND PAGING enabled, an active backing store, and at least one demand-paged page privately mapped into a user memory domain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.