CVE-2026-79979 zephyrproject CVE debrief

Who should care

Defenders responsible for systems built with Zephyr and arm64 architecture should assess exposure and prioritize patching. This includes reviewing system configurations, monitoring memory pressure, and ensuring patches are applied to prevent exploitation. Security teams should verify that CONFIG_USERSPACE and CONFIG_DEMAND_PAGING are not enabled in the build and monitor for potential exploitation attempts.

Why it matters

CVE-2026-79979 allows unprivileged code to access sensitive memory, potentially leading to information disclosure and system compromise. Defenders should prioritize patching and monitor system memory pressure.

• Information disclosure: sensitive data may be accessed by unauthorized parties
• Memory corruption: potentially leading to system compromise
• Verification priority: review and apply patches to prevent exploitation

Technical summary

The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which only matches ASID 0 (kernel page tables) and global entries. This allows user threads to retain valid EL0 read/write translations to physical frames under their own ASID, potentially leading to information disclosure and system compromise. The fix switches the implementation to TLBI VAAE1{IS}, which matches every ASID and both global and non-global entries, ensuring no domain-tagged translation survives a page out, dirty-bit update or access-flag clear.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch from https://github.com/zephyrproject-rtos/zephyr/commit/d732e9f808f16911d06769b3f756246f3528669f
• Verify that CONFIG_USERSPACE and CONFIG_DEMAND_PAGING are not enabled in your build
• Monitor system memory pressure and page eviction to detect potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the arm64 MMU backend invalidating a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c. This only matches ASID 0 (kernel page tables) and global entries, allowing user threads to retain valid EL0 read/write translations to physical frames under their own ASID.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.