CVE-2026-19574

Executive Summary

CVE-2026-19574 is an access-control vulnerability in the ARM64 MMU back-end of the Zephyr real-time operating system, where the address space identifier (ASID) allocator in arch_mem_domain_init() uses a bare round-robin counter against a pool of only 255 usable ASIDs. Once the counter wraps (after more than 255 memory domain initializations in a CONFIG_USERSPACE application), two live memory domains can be assigned the same ASID, and because domain-private mappings are installed non-global (MT_NG), the TLB can no longer distinguish their cached translations. The result is cross-domain memory disclosure and tampering by unprivileged user-mode threads on affected ARM64 SMP systems, yielding a CVSS 3.1 base score of 7.0 (High) with High confidentiality and integrity impact. No public exploit or Nuclei template exists, and no vendor fix is available as of this writing.

Technical Analysis

The flaw is rooted in how the Zephyr ARM64 MMU back-end assigns ASIDs to memory domains. The arch_mem_domain_init() routine in arch/arm64/core/mmu.c draws ASIDs from a monotonically incrementing round-robin counter. The counter is not checked against the number of ASIDs actually in use, and it is compared against VM_ASID_BITS, which is set to 8. That leaves only 255 usable ASIDs. When the counter wraps, arch_mem_domain_init() can return an ASID that is still held by a live domain, producing an alias.

This aliasing is only dangerous because of a second design property: domain-private mappings are installed with the MT_NG (non-global) attribute. Non-global mappings are distinguished in the TLB solely by the ASID. If two distinct translation-table sets (two domains) share an ASID, the hardware has no way to tell their cached translations apart. The architecture assumes distinct translation-table sets never share an ASID; violating that invariant breaks the isolation the MMU is supposed to enforce.

The context-switch path compounds the problem. z_arm64_swap_ptables() only performs a TLB flush when the outgoing and incoming domains carry the same ASID. That covers the direct A-to-A transition, but it does not cover a duplicate reached through an intervening domain. Concretely, for domains A and C that share an ASID and an unrelated domain B, the schedule A -> B -> C never enters the same-ASID flush branch. The ASID-tagged TLB entries populated while A was running remain resident while C executes, so C can reach translations that belong to A. Under SMP, the situation is worse: two live domains sharing an ASID can be resident on two CPUs simultaneously, a state the architecture explicitly does not permit for distinct translation-table sets.

There is a meaningful constraint on reachability. Driving the counter to wrap requires a CONFIG_USERSPACE application on ARM64 that creates more than 255 memory domains over its lifetime. k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only APIs and are not exposed as syscalls, so an unprivileged thread cannot advance the counter directly. Reaching the vulnerable state therefore requires either a supervisor-privileged workload that legitimately churns through many domains, or a separate privilege-escalation primitive to call those APIs. The description indicates the ASID counter advances monotonically and is never recycled against live domains, so the duplicate-assignment surface persists after the first wrap.

The CWE classification is CWE-284 (Improper Access Control). The CVSS vector reflects this: local access (AV:L) and a high attack-complexity (AC:H) driven by the 255-domain precondition, but High confidentiality (C:H) and integrity (I:H) impact once aliasing occurs, with no availability (A:N) or scope (S:U) change. No public proof-of-concept or exploit code has been observed for this issue, and no CISA KEV, Nuclei template, or OSV package entry is associated with it.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the behavior described in the NVD entry. It relies exclusively on identifiers present in that description.

1. Reconnaissance / target identification. An attacker must first identify an ARM64 Zephyr device running a CONFIG_USERSPACE application that creates memory domains. Because k_mem_domain_init() and k_mem_domain_deinit() are supervisor-only, the attacker needs either (a) a supervisor-privileged execution path (a compromised kernel thread or driver) that can invoke those APIs legitimately, or (b) an application that already exceeds 255 domain initializations across its lifetime, which is a documented workload pattern rather than an attack step. During reconnaissance the attacker determines whether the target's application approaches the ASID pool limit and whether SMP is enabled.

2. Triggering the flaw class. The attacker, via a supervisor path, causes memory domain creation to continue past 255 so the round-robin counter in arch_mem_domain_init() wraps. Once wrapped, the allocator can hand out an ASID still held by a live domain — creating an alias between two domains (e.g., A and C) that the architecture assumes are disjoint. This is an access-control failure: the allocator no longer enforces the uniqueness invariant that the non-global (MT_NG) mappings depend on.

3. Payload / execution at the flaw class. A user-mode thread running in the aliased domain C schedules in. The context-switch path in z_arm64_swap_ptables() flushes the TLB only when the outgoing and incoming domains share an ASID. For a schedule of the form A -> B -> C (where B is an unrelated domain), the flush branch is never taken, so ASID-tagged translations populated by A remain resident in the TLB while C runs. The thread in C then reads and writes memory belonging to A's partitions and thread stacks. No custom payload is required; the attacker simply performs normal memory accesses that the MMU wrongly resolves to the other domain's mappings.

4. Post-exploitation impact. The aliased state allows a user-mode thread in one domain to read and write memory belonging to another domain's partitions and thread stacks. On SMP, two live domains sharing an ASID can additionally be resident on two CPUs at once, expanding the window and the reachable surface. Successful exploitation yields cross-domain confidentiality and integrity compromise — potentially bypassing user/kernel separation if a privileged domain is aliased — from an unprivileged local thread. Availability is not directly affected per the CVSS vector.

Impact Assessment

Successful exploitation gives a low-privileged user-mode thread the ability to read from and write to memory that belongs to a different memory domain's partitions and thread stacks. This breaks the core isolation guarantee of Zephyr's CONFIG_USERSPACE model on ARM64. Confidentiality is rated High (C:H) because secrets, keys, or buffered data in an aliased domain become readable; integrity is rated High (I:H) because the same mappings can be modified, enabling data corruption or logic subversion in the victim domain. Availability is A:N — the flaw does not directly cause a denial of service. Scope is Unchanged (S:U) because the impact stays within the vulnerable component's security authority as scored. The attack complexity is High (AC:H) due to the 255-domain wrap precondition, and privileges required are Low (PR:L) reflecting the unprivileged user-mode thread that ultimately performs the cross-domain access. No user interaction (UI:N) is needed. The overall base score is 7.0 (High). Blast radius includes any ARM64 Zephyr device running CONFIG_USERSPACE with a workload that cycles through many memory domains, and it widens on SMP systems where two aliased domains can be co-resident across CPUs. Because no patch exists and the ASID constraint is architectural (VM_ASID_BITS = 8), remediation requires either vendor code changes to the allocator and flush logic or reducing domain churn, which is not always feasible for long-lived applications. Embedded, automotive, industrial, and medical devices built on Zephyr are representative targets.

Detection Guidance

Sigma Rule

title: Potential Zephyr ARM64 Memory Domain ASID Aliasing
id: 9f4c1a72-3b8e-4d61-9c2a-7e5f0b1d8a34
status: experimental
description: Detects conditions consistent with CVE-2026-19574 - excessive ARM64 memory domain initialization that could wrap the Zephyr ASID counter (VM_ASID_BITS=8) and cause cross-domain TLB aliasing.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19574
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  selection_domain:
    message|contains:
      - 'arch_mem_domain_init'
      - 'mem_domain'
      - 'k_mem_domain_init'
  selection_asid:
    message|contains:
      - 'ASID'
      - 'VM_ASID_BITS'
      - 'z_arm64_swap_ptables'
  condition: selection_domain and selection_asid
falsepositives:
  - Legitimate high-volume domain creation in a controlled test harness
  - Debug builds with verbose MMU logging
level: medium

YARA Rule

rule CVE_2026_19574_Zephyr_ARM64_ASID_Alias
{
    meta:
        description = "Detects Zephyr ARM64 MMU back-end artifacts related to CVE-2026-19574 ASID allocation flaw"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19574"
        date = "2026-01-01"

    strings:
        $s1 = "arch_mem_domain_init" ascii
        $s2 = "z_arm64_swap_ptables" ascii
        $s3 = "VM_ASID_BITS" ascii
        $s4 = "MT_NG" ascii
        $s5 = "k_mem_domain_init" ascii
        $s6 = "k_mem_domain_deinit" ascii

    condition:
        uint32be(0) == 0x7F454C46 and 3 of ($s*)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-19574 - Zephyr ARM64 ASID counter wrap / domain aliasing activity"; flow:stateless; dsize:0; threshold:type both, track by_src, count 256, seconds 60; classtype:attempted-admin; reference:cve,CVE-2026-19574; metadata:affected_product Zephyr, deployment Embedded; sid:202619574; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name == "zephyr" and
  process.args like~ ("*mem_domain*", "*k_mem_domain_init*", "*k_mem_domain_deinit*")

Splunk SPL Query

index=embedded OR index=ot
(source="zephyr_console" OR sourcetype="zephyr:kernel")
("arch_mem_domain_init" OR "z_arm64_swap_ptables" OR "k_mem_domain_init" OR "VM_ASID_BITS")
| stats count as domain_events by host, source
| where domain_events > 255
| table host, source, domain_events

Wazuh OSSEC Rule

<group name="zephyr,cve-2026-19574,">
  <rule id="100574" level="10">
    <decoded_as>json</decoded_as>
    <field name="log">\.*(arch_mem_domain_init|z_arm64_swap_ptables|VM_ASID_BITS|k_mem_domain_init)\.*</field>
    <description>CVE-2026-19574: Zephyr ARM64 memory domain / ASID allocator activity detected - possible ASID counter wrap and domain aliasing</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Reduce or eliminate the precondition: audit all ARM64 CONFIG_USERSPACE applications for workloads that call k_mem_domain_init() and k_mem_domain_deinit() more than 255 times over the device lifetime, and refactor to reuse a bounded set of memory domains rather than churning new ones. Where the workload cannot be refactored, disable CONFIG_USERSPACE on the affected ARM64 target if the application does not require user-mode isolation, or move the workload to a non-ARM64 Zephyr target whose MMU back-end does not use the VM_ASID_BITS = 8 ASID scheme. Because the counter advances monotonically and is not recycled against live domains, there is no configuration switch that makes the wrap safe; address the domain-creation volume directly.

2. Patch/upgrade steps. No vendor fix exists as of this writing. Track the Zephyr project for a change to arch/arm64/core/mmu.c that makes arch_mem_domain_init() allocate ASIDs against the set of currently live domains (rather than a bare round-robin counter) and/or broadens the flush condition in z_arm64_swap_ptables() so a duplicate reached through a third domain forces a TLB flush. Until such a change lands, treat the device class as vulnerable and apply the workload-level mitigations above. There is no workaround supplied by the vendor.

3. Long-term hardening. Require that long-lived embedded applications bound their memory-domain count well below the VM_ASID_BITS limit, and add build-time or runtime assertions that fail safe when domain creation approaches 255. In multi-tenant or safety-critical deployments, isolate functions that create domains so that a non-global mapping cannot alias after a counter wrap, and prefer designs in which the number of live domains is static. Monitor the Zephyr security advisories and NVD entry for an updated fixed version and re-evaluate patch status when it appears.

References

1. NVD — CVE-2026-19574: https://nvd.nist.gov/vuln/detail/CVE-2026-19574
2. Zephyr Project ASID / MMU architecture documentation: https://docs.zephyrproject.org/latest/hardware/arch/arm64.html
3. Zephyr Project security advisories: https://github.com/zephyrproject-rtos/zephyr/security/advisories
4. CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
5. FIRST EPSS: not yet scored — https://www.first.org/epss/