CVE-2026-10635: Zephyr Use-After-Free Vulnerability

CVE-2026-10635 Overview

CVE-2026-10635 is a use-after-free vulnerability [CWE-416] in the Zephyr real-time operating system. The flaw resides in the Xtensa page-table code at arch/xtensa/core/ptables.c and affects builds compiled with CONFIG_USERSPACE and CONFIG_XTENSA_MMU. When k_mem_domain_deinit() tears down a memory domain, the domain's node is not removed from the global xtensa_domain_list. Subsequent memory mapping operations traverse the stale node and dereference freed or reused caller-owned storage. Exploitation requires privileged kernel or supervisor code paths, not unprivileged user threads. The vulnerable code first shipped in Zephyr v4.4.0.

Critical Impact
A dangling list node in xtensa_domain_list enables use-after-free during page-table walks, producing MMU faults or page-table memory corruption that undermines userspace isolation.

Affected Products

Zephyr v4.4.0 on Xtensa targets
Builds with CONFIG_USERSPACE and CONFIG_XTENSA_MMU enabled
Xtensa MPU configurations are not affected

Discovery Timeline

2026-06-16 - CVE-2026-10635 published to NVD
2026-06-17 - Last updated in NVD database
Patch published via Zephyr commit 33d43d09337119fc6084b4ab545f9267839973f6 and GitHub Security Advisory GHSA-39v7-cx8j-gq82

Technical Details for CVE-2026-10635

Vulnerability Analysis

The Xtensa memory management code maintains xtensa_domain_list, a global singly-linked list of active memory domains. Each entry uses a sys_snode_t node embedded inside the caller-owned struct k_mem_domain. When arch_mem_domain_deinit() runs, the implementation sets domain->arch.ptables = NULL and tears down the page tables but never unlinks the domain node from the global list. The freed domain remains reachable through list traversal.

Any later call to arch_mem_map() or arch_mem_unmap() walks the stale list entry. The walker dereferences domain->arch.ptables, which is either NULL or, if the caller's storage has been freed and reused, attacker-influenced data. Both l2_page_table_map and xtensa_mmu_compute_domain_regs perform writes through this pointer.

Root Cause

The root cause is missing list cleanup during domain deinitialization. The domain owner controls the lifetime of the embedded list node, but the architecture layer does not detach the node before the owner reclaims the memory. The fix calls sys_slist_find_and_remove() to unlink the node before releasing the lock.

Attack Vector

The vulnerable path is reachable only from privileged kernel or supervisor code because k_mem_domain_deinit is not exposed as a syscall. An attacker with the ability to influence kernel code paths that destroy and reallocate memory domains can trigger either a denial of service through a NULL pointer dereference fault or page-table corruption when reused storage contains a controlled ptables value.

// Fix in arch/xtensa/core/ptables.c
	domain->arch.ptables = NULL;

+	sys_slist_find_and_remove(&xtensa_domain_list, &domain->arch.node);
+
	k_spin_unlock(&xtensa_mmu_lock, key);

	K_SPINLOCK(&xtensa_counter_lock) {

Source: Zephyr commit 33d43d0

The patch removes the dangling node from xtensa_domain_list immediately after clearing arch.ptables, eliminating the stale reference that triggered the use-after-free.

Detection Methods for CVE-2026-10635

Indicators of Compromise

Unexpected fatal MMU exceptions on Xtensa targets shortly after a memory domain is destroyed
Kernel panics originating in l2_page_table_map or xtensa_mmu_compute_domain_regs
Page-table walks that dereference unexpected or zeroed ptables pointers

Detection Strategies

Audit firmware builds for CONFIG_USERSPACE=y combined with CONFIG_XTENSA_MMU=y on Zephyr v4.4.0
Static analysis of the running image to confirm presence of the sys_slist_find_and_remove call inside arch_mem_domain_deinit
Stress-test memory domain init and deinit cycles in CI and monitor for MMU faults

Monitoring Recommendations

Capture kernel fault logs from Xtensa devices and alert on MMU exceptions following domain teardown
Track Zephyr versions across deployed device fleets and flag any units still running v4.4.0 without the patch
Review crash dumps for repeated faults at the same page-table walker addresses

How to Mitigate CVE-2026-10635

Immediate Actions Required

Upgrade Zephyr to a version that includes commit 33d43d0 on main, or backport the patch into v4.4.0 builds
Inventory Xtensa-based devices and identify those compiled with CONFIG_USERSPACE and CONFIG_XTENSA_MMU
Rebuild and reflash affected firmware before re-enabling features that depend on memory domain teardown

Patch Information

The fix adds sys_slist_find_and_remove(&xtensa_domain_list, &domain->arch.node) inside arch_mem_domain_deinit() in arch/xtensa/core/ptables.c. See the Zephyr commit and the GHSA-39v7-cx8j-gq82 advisory for full details.

Workarounds

Avoid calling k_mem_domain_deinit() in long-running firmware where teardown is not strictly required
Switch affected targets to the Xtensa MPU path, which is not affected
Disable CONFIG_USERSPACE on Xtensa MMU builds where userspace isolation is not needed

bash

# Verify Zephyr configuration on affected targets
grep -E 'CONFIG_USERSPACE|CONFIG_XTENSA_MMU' build/zephyr/.config

# Confirm the patched call is present in the source tree
grep -n 'sys_slist_find_and_remove' arch/xtensa/core/ptables.c