CVE Explorer

CVE-2026-10635

On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of active memory domains using a list node embedded inside the caller-owned struct k_mem_domain. When a domain is destroyed via k_mem_domain_deinit() -> arch_mem_domain_deinit(), the page tables are torn down and domain->arch.ptables is set to NULL, but the domain's node was not removed from xtensa_domain_list. The freed/deinitialized domain

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d58eabd50f8b502fa735246ee4ff41de95b8328cf81f657779abb93a77292802

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["arch/xtensa/core/ptables.c"],"vendor":"zephyrproject","versions":[{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:bce8bb54485a901d4d0ba2667c9d4a989629485156507ab162a898f3c9fdd5c9 · sha256:44e4c622e4ebb6f8… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:bce8bb54485a901d4d0ba2667c9d4a989629485156507ab162a898f3c9fdd5c9 · sha256:44e4c622e4ebb6f8… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-416","description":"use-after-free","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:bce8bb54485a901d4d0ba2667c9d4a989629485156507ab162a898f3c9fdd5c9 · sha256:44e4c622e4ebb6f8… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"Fix commit","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/33d43d09337119fc6084b4ab545f9267839973f6"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:bce8bb54485a901d4d0ba2667c9d4a989629485156507ab162a898f3c9fdd5c9 · sha256:44e4c622e4ebb6f8… · /containers/cna/references/0

{"name":"GHSA-39v7-cx8j-gq82","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-39v7-cx8j-gq82"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:bce8bb54485a901d4d0ba2667c9d4a989629485156507ab162a898f3c9fdd5c9 · sha256:44e4c622e4ebb6f8… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer