CVE-2026-10635

{
  "id": "CVE-2026-10635",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-16T06:16:57.770",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of active memory domains using a list node embedded inside the caller-owned struct k_mem_domain. When a domain is destroyed via k_mem_domain_deinit() -> arch_mem_domain_deinit(), the page tables are torn down and domain->arch.ptables is set to NULL, but the domain's node was not removed from xtensa_domain_list. The freed/deinitialized domain therefore remained linked into the global list as a dangling pointer into caller-owned storage that may then be freed or reused.\n\nAny subsequent arch_mem_map()/arch_mem_unmap() operation (widely invoked by kernel memory-mapping and demand-paging code) traverses the stale node and dereferences domain->ptables: at minimum a NULL pointer dereference causing a fatal MMU exception (denial of service), and if the k_mem_domain storage has been freed or reused, a use-after-free in which a stale/controlled ptables value is dereferenced and written through during the page-table walk (l2_page_table_map writes l1_table[...] and l2_table[...], and xtensa_mmu_compute_domain_regs writes into the domain struct and the L1 table), yielding page-table memory corruption that can undermine userspace isolation.\n\nThe vulnerable path is reachable only from privileged kernel/supervisor code (k_mem_domain_deinit is not a syscall), not directly from unprivileged user threads or remotely. Affected: Zephyr v4.4.0 (the Xtensa memory-domain de-initialization feature was introduced in commit 3032b58f52d and first shipped in v4.4.0); fixed on main by adding sys_slist_find_and_remove() in arch_mem_domain_deinit(). The Xtensa MPU path is unaffected."
    },
    {
      "lang": "es",
      "value": "En objetivos Xtensa con CONFIG_USERSPACE y CONFIG_XTENSA_MMU, el código de la tabla de páginas (arch/xtensa/core/ptables.c) mantiene una lista global, xtensa_domain_list, de dominios de memoria activos utilizando un nodo de lista incrustado dentro de la estructura k_mem_domain propiedad del llamador. Cuando un dominio es destruido a través de k_mem_domain_deinit() - arch_mem_domain_deinit(), las tablas de páginas son desmanteladas y domain-arch.ptables se establece en NULL, pero el nodo del dominio no fue eliminado de xtensa_domain_list. El dominio liberado/desinicializado, por lo tanto, permaneció vinculado a la lista global como un puntero colgante a un almacenamiento propiedad del llamador que luego puede ser liberado o reutilizado. Cualquier operación posterior de arch_mem_map()/arch_mem_unmap() (ampliamente invocada por el código de mapeo de memoria del kernel y paginación bajo demanda) atraviesa el nodo obsoleto y desreferencia domain-ptables: como mínimo una desreferencia de puntero NULL que causa una excepción MMU fatal (denegación de servicio), y si el almacenamiento de k_mem_domain ha sido liberado o reutilizado, un uso después de liberación en el que un valor obsoleto/controlado de ptables es desreferenciado y escrito durante el recorrido de la tabla de páginas (l2_page_table_map escribe l1_table[...] y l2_table[...], y xtensa_mmu_compute_domain_regs escribe en la estructura del dominio y la tabla L1), lo que produce corrupción de memoria de la tabla de páginas que puede socavar el aislamiento del espacio de usuario. La ruta vulnerable es accesible solo desde código privilegiado de kernel/supervisor (k_mem_domain_deinit no es una llamada al sistema), no directamente desde hilos de usuario sin privilegios o de forma remota. Afectado: Zephyr v4.4.0 (la característica de desinicialización de dominio de memoria Xtensa fue introducida en el commit 3032b58f52d y se lanzó por primera vez en v4.4.0); corregido en main añadiendo sys_slist_find_and_remove() en arch_mem_domain_deinit(). La ruta MPU de Xtensa no se ve afectada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "arch/xtensa/core/ptables.c"
          ],
          "versions": [
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.5
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-16T13:47:03.831041Z",
          "id": "CVE-2026-10635",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:4.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCD89951-E5B1-416E-B009-99D2CFB72BFD"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/33d43d09337119fc6084b4ab545f9267839973f6",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-39v7-cx8j-gq82",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}