Zephyr’s ARM64 MMU backend assigns address space identifiers (ASIDs) to memory domains using a simple round‑robin counter. With only 255 unique 8‑bit ASIDs, the counter can wrap and the code may hand an ASID that is already in use by a live domain. Because domain‑specific translations are installed as non‑global TLB entries, the ASID is the sole tag that isolates one domain’s cached TLB entries from another’s. The context‑switch routine does not flush the TLB when two different domains inadvertently share the same ASID unless the incoming and outgoing domains are identical, which allows duplicate entries to remain resident. Consequently, when two live domains alias the same ASID, a user‑mode thread in one domain can access memory belonging to the other domain, breaking the intended isolation boundary and enabling a privilege escalation within the same application.

Zephyr RTOS running on ARM64 architecture. The vulnerability exists in any Zephyr build that uses the described ASID allocation scheme in arch/arm64/core/mmu.c before the commit that introduces the mitigation. No specific release identifiers are listed; therefore, all current and previous versions without the patch are affected.

The CVSS score of 7 signals a high‑severity bug. Exploitation requires creating more than 255 memory domains, an action only possible through supervisor‑level API calls (k_mem_domain_init/k_mem_domain_deinit). Thus the attack must originate from local kernel code or an application with kernel privileges. Once the counter wraps and an alias is created, a user‑mode thread can read or write memory allocated to other domains, effectively elevating privileges within the same user context. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. The risk is therefore confined to systems that enable unrestricted domain creation; however, because the alias allows cross‑domain memory access, the impact is significant for those deployments.