Zephyr RTOS CVE-2026-79979

Requires an arm64 Zephyr build with BOTH CONFIG_USERSPACE and CONFIG_DEMAND_PAGING (the latter is marked EXPERIMENTAL) enabled, an active backing store, and at least one demand-paged page that is also privately mapped into a user memory domain - specifically a k_mem_partition added via arch_mem_domain_partition_add() or a user thread stack mapped by map_thread_stack(). The attacker must already be executing unprivileged code in a user thread (PR:L) on the device and must drive memory pressure to force eviction and frame reuse (AC:H). Exploitation is limited to versions 4.3.0 through 4.4.2 on arm64; non-arm64 targets, builds without demand paging or userspace, and deployments with no privately-mapped demand-paged pages are not affected.

This is a genuine high-severity isolation bypass but not an emergency. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, 7.8 High) is internally consistent with the description: a local, already-present unprivileged user thread (PR:L, AV:L) must force demand-paging eviction and reuse a frame it previously mapped (AC:H), then crosses the CONFIG_USERSPACE trust boundary (S:C) to read and write supervisor data, another domain's partition, or another thread's stack (C:H/I:H/A:H). No EPSS score, no CISA KEV entry, and no PoC/exploit reference are present in the input, so by the precision rules this is 'no public exploit identified at time of analysis' - though the fixing commit diff publicly documents the exact mechanism (ASID field always 0 in TLBI VAE1, non-global domain leaves surviving the flush), which lowers the research barrier. The vuln.today Decision label is 'this_week', which aligns with act-this-week urgency rather than act_now/emergency; combined with a vendor patch available and the EXPERIMENTAL status of CONFIG_DEMAND_PAGING, real-world exposure is narrow. The signals do not conflict, but note that despite CRITICAL-level impact (full system compromise), the required build configuration sharply limits the population of actually vulnerable deployments.

On an affected arm64 Zephyr build, an attacker running unprivileged code inside a user thread drives memory pressure to force the demand-paging eviction algorithm to reclaim a page the thread had privately mapped (a k_mem_partition or its own stack). Because invalidate_tlb_page() flushed only ASID 0 while the domain's non-global entry lived under ASID >= 1, the thread's EL0 translation survives, so it keeps accessing the stale virtual address and now reads/writes whatever the kernel placed in that reused physical frame. No public exploit exists, but the fixing commit describes the trigger in full detail.