# CVE-2026-79979: Zephyr arm64 MMU TLB invalidation memory isolation bypass

Source: https://junglewise.ai/threats/cve-2026-79979-the-arm64-mmu-backend-invalidates-a-single-virtual-address-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-79979 · Severity: high · CVSS 7.8 · Published 2026-10-23

Zephyr's arm64 memory management unit fails to properly invalidate cached translation entries when pages are evicted, allowing unprivileged user-space code to retain access to physical memory frames that have been reassigned by the kernel. An attacker can exploit memory pressure to force page eviction and then read or write sensitive kernel data, other domains' memory, or other threads' stacks, completely bypassing Zephyr's memory isolation when userspace is enabled.

Technologies: [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-79979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79979 being exploited in the wild.

**How severe is CVE-2026-79979?** High severity, with a CVSS score of 7.8, published 23 October 2026.

**Which products and versions are affected?** Zephyr Project Zephyr OS prior to fix commit.

**Is there a fix for CVE-2026-79979?** No fixed version is recorded yet. Do not enable CONFIG_USERSPACE with CONFIG_DEMAND_PAGING on arm64 builds until patched, or ensure no demand-paged pages are privately mapped into user memory domains. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79979 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-79979?** Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not enable CONFIG_USERSPACE with CONFIG_DEMAND_PAGING on arm64 builds until patched, or ensure no demand-paged pages are privately mapped into user memory domains.

## Technical details

The arm64 MMU backend in arch/arm64/core/mmu.c uses TLBI VAE1{IS} instruction with an operand that only invalidates ASID 0 (kernel) and global entries, but fails to invalidate non-global entries for domain-allocated ASIDs (ASID ≥ 1). When page_frame_prepare_locked() reclaims a frame during demand paging, the TLB flush misses domain-private translations. A user thread retains a valid cached translation to the evicted physical frame under its own ASID, and when do_page_fault() reuses that frame for new mappings, the stale translation allows read/write access to the new contents (kernel data, other domains' partitions, or other threads' stacks). The fix changes the instruction to TLBI VAAE1{IS} which invalidates all ASIDs.

## Affected products

- Zephyr Project Zephyr OS prior to fix commit

## Timeline

- 2026-10-23: disclosed

## Related threats

- [Zephyr MCTP over USB use-after-free in packet buffer handling](https://junglewise.ai/threats/cve-2026-85032-the-mctp-over-usb-device-class-in-subsys-pmci-mctp-mctp-usb-c)
- [Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsing](https://junglewise.ai/threats/cve-2026-76787-the-updatehub-firmware-over-the-air-client-parses-the-coap-probe)
- [CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsing](https://junglewise.ai/threats/cve-2026-75084-the-cc1200-sub-ghz-ieee-802-15-4-driver-takes-the-phy-packet)
- [Zephyr Bluetooth Link Layer memory leak in connection update](https://junglewise.ai/threats/cve-2026-19739-the-bluetooth-link-layer-control-procedure-code-in-subsys)
- [Zephyr Project Bluetooth Link Layer Control Procedure memory leak in CIS creation](https://junglewise.ai/threats/cve-2026-19738-the-bluetooth-link-layer-control-procedure-llcp-implementation)