CVE-2026-10635

Name of the Vulnerable Software and Affected Versions Zephyr version 4.4.0

Description On Xtensa targets configured with CONFIG USERSPACE and CONFIG XTENSA MMU, the page-table code in arch/xtensa/core/ptables.c fails to remove a domain's node from the global xtensa domain list when a domain is destroyed via the k mem domain deinit() (also known as arch mem domain deinit()) function. This results in a dangling pointer in the global list. Subsequent operations using arch mem map() or arch mem unmap() traverse this stale node and dereference domain-ptables. This can lead to a NULL pointer dereference, causing a denial of service, or a use-after-free condition if the storage has been reused. In the latter case, a controlled value may be written during the page-table walk via l2 page table map and xtensa mmu compute domain regs, potentially causing page-table memory corruption and undermining userspace isolation. This issue is only reachable from privileged kernel or supervisor code.

Recommendations Update Zephyr version 4.4.0 to a version where sys slist find and remove() has been added to arch mem domain deinit().