The flaw resides in the Xtensa MMU page‑table code of Zephyr on Xtensa CPUsSPACE and CONFIG_XTENSA_MMU are enabled. The kernel maintains a global list of memory domains, and during domain de‑initialisation the list entrytables are cleared. The dangling node remains in the arch_mem_unmap() operation traverses this stale entry and dereferences a NULL or corrupted ptables pointer. The result is a fatal MMU exception that brings the system down (denial of service). If the memory previously used for the domain has been freed or reused, the stale pointer can be exploited to write through the page‑table entries, corrupting memory and potentially breaking userspace isolation. The vulnerability can only be triggered from privileged kernel or supervisor code and is therefore not directly exploitable by ordinary user applications or remote attackers.

The issue appears in Zephyr v4.4.0 on Xtensa CPUs when both CONFIG_USERSPACE and CONFIG_XTENSA_MMU are enabled. It was introduced in commit 3032b58f52d and shipped with v4.4.0. The mainline pull request that adds sys_slist_find_and_mem_domain_deinit() removes the dangling node and resolves the flaw. The Xtensa MPU path is unaffected.

The CVSS score of 6.3 indicates a moderate severity for this flaw. The EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA KEV, so no publicly known exploits exist. The code path is reachable only from privileged kernel or supervisor code; unprivileged user threads and remote attackers have no direct access to trigger the flaw.