Memory Isolation Vulnerability in Zephyr RTOS ARM64 Architecture

CVE-2026-19574

What is CVE-2026-19574?

This vulnerability in the Zephyr RTOS ARM64 architecture allows for memory domain isolation breaches due to improper handling of address space identifiers (ASIDs). The allocation of ASIDs using a bare round-robin counter can lead to scenarios where two live memory domains unintentionally share the same ASID, permitting a user-mode thread in one domain to access the memory of another domain. This flaw circumvents the intended isolation between domains, posing a significant security risk. The resolution involves ensuring that AS IDs are only assigned when available, thus preventing silent aliasing of memory domains.

References