Memory Management Flaw in Xtensa MMU by Zephyr Project

CVE-2026-90586

What is CVE-2026-90586?

A vulnerability exists in the Xtensa MMU user's thread setup due to the failure to initialize the per-thread page-table pointer. This oversight allows unprivileged user-mode threads to exploit stale data in the memory, potentially leading to out-of-bounds memory access and kernel memory corruption. The vulnerability can be triggered in configurations where dynamic memory allocation occurs, providing attackers the ability to influence kernel behavior through crafted memory allocations. Ultimately, this could result in unauthorized access or crashes of the kernel, making it a significant concern for systems using the Xtensa MMU architecture.

References