Description
The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidation only ever matched ASID 0 (the kernel page tables) and global entries. Memory domains, however, are allocated ASIDs starting at 1 in arch_mem_domain_init(), and every domain-private leaf created by private_map() is mapped with MT_NG, i.e. non-global. A domain's cached translation therefore survived the invalidation.

All callers of invalidate_tlb_page() are demand-paging paths. When the eviction algorithm reclaims a frame, page_frame_prepare_locked() in kernel/mmu.c calls arch_mem_page_out(), which marks the kernel leaf invalid, propagates the invalid descriptor into every domain via sync_domains(), and then flushes only ASID 0. do_page_fault() immediately reuses the very same page frame for the incoming mapping through arch_mem_page_in(). A user thread that had already touched the evicted page — a k_mem_partition added with arch_mem_domain_partition_add(), or its own stack mapped by map_thread_stack() — retains a valid EL0 read/write translation to that physical frame under its own ASID.

Unprivileged code running in a user thread can drive memory pressure to force eviction and then keep accessing the stale address, obtaining read and write access to whatever the kernel subsequently placed in that frame: supervisor data, another memory domain's partition, or another thread's stack. This defeats the isolation that CONFIG_USERSPACE is meant to enforce, allowing information disclosure and memory corruption up to full compromise of the system.

The fix switches the implementation to TLBI VAAE1{IS}, which matches every ASID and both global and non-global entries, so no domain-tagged translation survives a page out, dirty-bit update or access-flag clear. Exploitation requires an arm64 build with both CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled, an active backing store, and at least one demand-paged page that is also privately mapped into a user memory domain. The same commit additionally stops globalize_table() from stripping EL0 permission and non-global attributes off domain-private leaves during paging synchronization, which previously caused user threads to lose access to their own partitions and stacks.
Published: 2026-10-23
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: Privilege Escalation via TLB bug
Action: Immediate Patch
AI Analysis

Impact

A flaw in Zephyr’s arm64 MMU backend causes page‑out operations to invalidate only ASID 0 entries, leaving translations from other user memory domains intact. When a user process triggers a page eviction, it can later access the same physical frame that the kernel reclaims, reading or writing kernel data, other userspace partitions, or different thread stacks. This breaks userspace isolation, enabling information disclosure, memory corruption, and full system compromise.

Affected Systems

All Zephyr RTOS ARM64 builds that enable CONFIG_USERSPACE and CONFIG_DEMAND_PAGING and use a backing store for demand‑paged pages, unless the patch in commit d732e9f8 has been applied. No specific version range is listed, so any unpatched build is regarded as vulnerable.

Risk and Exploitability

The vulnerability scores 7.8 on the CVSS scale, indicating high severity. Exploitation requires local conditions: the presence of an unprivileged user thread, the ability to generate memory pressure to force page eviction, and enabled userspace isolation and demand paging. No publicly available exploit exists and the EPSS score is not provided, but the flaw could be leveraged by a local attacker to fully compromise the device. The system is not listed in the CISA KEV catalog, suggesting mass exploitation has not yet been observed.

Generated by OpenCVE AI on October 23, 2026 at 21:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Zephyr to a version that includes commit d732e9f8, which corrects the TLB invalidation logic.
  • If an upgrade cannot be performed immediately, disable CONFIG_DEMAND_PAGING or CONFIG_USERSPACE to prevent the conditions that lead to stale TLB entries.
  • Rebuild Zephyr with the fixed code or apply the patch manually, then restart the system to clear any stale translations.

Generated by OpenCVE AI on October 23, 2026 at 21:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Description The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand encodes the ASID in bits [63:48], so the invalidation only ever matched ASID 0 (the kernel page tables) and global entries. Memory domains, however, are allocated ASIDs starting at 1 in arch_mem_domain_init(), and every domain-private leaf created by private_map() is mapped with MT_NG, i.e. non-global. A domain's cached translation therefore survived the invalidation. All callers of invalidate_tlb_page() are demand-paging paths. When the eviction algorithm reclaims a frame, page_frame_prepare_locked() in kernel/mmu.c calls arch_mem_page_out(), which marks the kernel leaf invalid, propagates the invalid descriptor into every domain via sync_domains(), and then flushes only ASID 0. do_page_fault() immediately reuses the very same page frame for the incoming mapping through arch_mem_page_in(). A user thread that had already touched the evicted page — a k_mem_partition added with arch_mem_domain_partition_add(), or its own stack mapped by map_thread_stack() — retains a valid EL0 read/write translation to that physical frame under its own ASID. Unprivileged code running in a user thread can drive memory pressure to force eviction and then keep accessing the stale address, obtaining read and write access to whatever the kernel subsequently placed in that frame: supervisor data, another memory domain's partition, or another thread's stack. This defeats the isolation that CONFIG_USERSPACE is meant to enforce, allowing information disclosure and memory corruption up to full compromise of the system. The fix switches the implementation to TLBI VAAE1{IS}, which matches every ASID and both global and non-global entries, so no domain-tagged translation survives a page out, dirty-bit update or access-flag clear. Exploitation requires an arm64 build with both CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled, an active backing store, and at least one demand-paged page that is also privately mapped into a user memory domain. The same commit additionally stops globalize_table() from stripping EL0 permission and non-global attributes off domain-private leaves during paging synchronization, which previously caused user threads to lose access to their own partitions and stacks.
Title Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-10-23T19:56:16.111Z

Reserved: 2026-08-25T16:06:32.777Z

Link: CVE-2026-79979

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T20:17:27.783

Modified: 2026-10-23T20:17:27.783

Link: CVE-2026-79979

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T21:45:14Z

Weaknesses