Is CVE-2026-19574 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19574 being exploited in the wild.

How severe is CVE-2026-19574?

High severity, with a CVSS score of 7, published 9 October 2026.

Which products and versions are affected?

Zephyr Project Zephyr Before fix applied.

How is CVE-2026-19574 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-19574?

Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19574: Zephyr ARM64 MMU ASID allocation collision in memory domain isolation

CVE-2026-19574 · Severity: high · CVSS 7 · Published 2026-10-09

Zephyr's real-time kernel on ARM64 processors manages memory isolation through domains that use address-space identifiers (ASIDs) to separate memory access. When more than 255 memory domains are created over time, the ASID counter wraps around and reuses identifiers, causing two different domains to share the same ASID. An unprivileged application thread can then read and write memory belonging to other domains, bypassing the kernel's memory isolation protections.

Technologies: Zephyr Project Zephyr. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-19574 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19574 being exploited in the wild.
How severe is CVE-2026-19574?: High severity, with a CVSS score of 7, published 9 October 2026.
Which products and versions are affected?: Zephyr Project Zephyr Before fix applied.
Is there a fix for CVE-2026-19574?: Yes: fixed in The fix scans the live domain_list before assigning an ASID and returns -ENOMEM when all ASIDs are taken, so domain creation fails closed instead of silently aliasing.. Until then: Restrict memory domain creation in CONFIG_USERSPACE applications to stay below 255 total domains over the application lifetime, or disable CONFIG_USERSPACE if multi-domain isolation is not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19574 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-19574?: Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: The fix scans the live domain_list before assigning an ASID and returns -ENOMEM when all ASIDs are taken, so domain creation fails closed instead of silently aliasing.

Restrict memory domain creation in CONFIG_USERSPACE applications to stay below 255 total domains over the application lifetime, or disable CONFIG_USERSPACE if multi-domain isolation is not required.

Technical details

The ARM64 MMU back-end uses a round-robin counter to allocate 8-bit ASIDs (limiting 255 unique values) to memory domains in arch_mem_domain_init(). When the counter wraps, two live domains can be assigned the same ASID. The TLB flush logic in z_arm64_swap_ptables() only flushes when switching between domains with identical ASIDs directly, missing aliases reached through intermediate domains or on separate CPU cores. A user-mode thread in a domain sharing an ASID with another domain can then access that domain's memory with full permissions.

Affected products

Zephyr Project Zephyr Before fix applied

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.