Memory Management Vulnerability in Zephyr RTOS Affecting Arm64 Architecture

CVE-2026-79979

What is CVE-2026-79979?

A vulnerability in the arm64 MMU backend of Zephyr RTOS enables unprivileged user threads to access kernel memory and other protected memory spaces. The flaw occurs during the invalidation of virtual addresses, where only ASID 0 (kernel page tables) is affected. This allows stale memory addresses to remain accessible after eviction, compromising isolation between user and kernel memory. A malicious actor could exploit this issue to read or write sensitive data, leading to potential system compromise. A fix has been implemented to ensure that all ASIDs are correctly invalidated, preventing unauthorized access.

References