{"id":"CVE-2026-19574","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-19574","generatedAt":"2026-10-28T00:18:49.155Z","title":"Under SMP two live domains sharing an ASID can additionally be resident on two CPUs at once, which the architecture does not allow for distinct translation-table sets.","description":"The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init() (arch/arm64/core/mmu.c). VM_ASID_BITS is 8, so only 255 ASIDs exist; once the counter wrapped, arch_mem_domain_init() could hand an ASID to a new domain while a still-live domain held the same one. Domain-private mappings are installed non-global (MT_NG), so the ASID is the only tag separating one domain's cached translations from another's in the TLB.\n\nThe context-switch path in z_arm64_swap_ptables() only flushes the TLB when the outgoing and incoming domains carry the same ASID, which does not cover a duplicate reached through a third domain: for domains A and C sharing an ASID and an unrelated domain B, the schedule A -> B -> C never takes the flush branch, so the ASID-tagged entries A populated remain resident while C runs. Under SMP two live domains sharing an ASID can additionally be resident on two CPUs at once, which the architecture does not allow for distinct translation-table sets.\n\nTriggering the wrap requires a CONFIG_USERSPACE application on ARM64 that creates more than 255 memory domains over its lifetime; k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only APIs and are not exposed as syscalls, so an unprivileged thread cannot drive the counter directly. Once two live domains alias, however, a user-mode thread in one domain can read and write memory belonging to the other domain's partitions and thread stacks with that domain's permissions, defeating the memory-domain isolation boundary.\n\nThe fix scans the live domain_list before assigning an ASID, advances the round-robin counter past ASIDs already in use, and returns -ENOMEM when all are taken, so domain creation fails closed instead of silently aliasing.","published":"2026-10-09T08:16:55.000Z","lastModified":"2026-10-09T18:17:08.000Z","status":"Awaiting Analysis","sourceIdentifier":"vulnerabilities@zephyrproject.org","cvss":{"version":"3.1","score":7,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-284"],"affected":[],"epss":{"score":0.00097,"percentile":0.00702,"date":"2026-10-26","history":[{"date":"2026-10-09","score":0.00097,"percentile":0.00683}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.10%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-09T08:16:55.000Z","detail":{"score":"7.0","severity":"HIGH","publishedAt":"2026-10-09T08:16:54.940Z"},"summary":"New CVE, high severity (CVSS 7.0)."}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/805054b8ed89dd5441fbca36b3cd3be7e4fb4100","source":"vulnerabilities@zephyrproject.org"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-923h-8c2j-pcm5","source":"vulnerabilities@zephyrproject.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-19574","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}