On Xtensa targets that enable user‑space and the Xtensa MMU, the kernel stores each memory domain in a global linked list. When a domain is de‑initialized, the kernel clears its page tables and sets the domain’s page‑table pointer to NULL, but it fails to remove the domain’s list node. The dangling node remains in the global list and subsequent memory‑mapping operations traverse it. If the domain’s storage is still valid, a NULL dereference occurs, causing a fatal MMU exception and denying service. If the container memory has been freed or repurposed, the stale node becomes a use‑after‑free that writes through the page‑table walk, corrupting memory and potentially breaking user‑space isolation. This is a CWE‑416 use‑after‑free weakness.

The flaw exists in Zephyr 4.4.0 and later when CONFIG_XTENSA_MMU (with CONFIG_USERSPACE) is compiled. The de‑initialization bug was introduced in commit 3032b58f52d and shipped with v4.4.0. The vendor fixed the issue by inserting sys_slist_find_and_remove() in arch_mem_domain_deinit(), which removes the dangling node from the global list. The Xtensa MPU path is not affected.

The CVSS score of 6.3 reflects moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV. Because the vulnerable code path is only reachable from privileged kernel or supervisor code, ordinary user threads or remote attackers cannot directly trigger the flaw.