144 matches found
CVE-2026-90586
The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...
CVE-2026-90586 Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes
The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...
EUVD-2026-120487
The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...
CVE-2026-90586 Xtensa MMU userspace: uninitialized thread page-table pointer leads to out-of-bounds supervisor-mode writes
The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...
CVE-2026-90586
The Zephyr RTOS Xtensa MMU userspace port is vulnerable to an uninitialized pointer issue because the thread->arch.ptables pointer is not initialized during thread setup. The function arch_mem_domain_thread_add() in arch/xtensa/core/ptables.c treats a non-NULL value in this field as a predicat...
CVE-2026-90586: zephyrproject zephyr: The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread…
The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...
PT-2026-141162
The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while arch mem domain thread add in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: xtensa: Fixed the refcount leak issue in the time.c file. In calibrateccount, the offindcompatiblenode function will return a node pointer with the refcount incremented. We should use ofnodeput when this function is no longer...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: xtensa: xtfpga: Fixed a refcount leak bug in setup. In machinesetup, offindcompatiblenode will return a node pointer with the refcount incremented. We should use ofnodeput when it is no longer needed...
CVE-2026-12235
The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...
CVE-2026-12235
The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...
CVE-2026-12235 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)
The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...
CVE-2026-12235 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)
The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...
EUVD-2026-57070
The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...
CVE-2026-12235 Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787)
The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...
CVE-2026-12235
The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...
CVE-2026-12235
The CVE describes an out-of-bounds write in the Xtensa llext PLT relocation path. Specifically, during relocation in llext_link_plt(), the patch address is computed using rela.r_offset without validating it, allowing a crafted RELA entry with a large r_offset to write outside the extension’s text...
CVE-2026-12235: Out-of-bounds Write
The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llextlinkplt subsys/llext/llextlink.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch address...
PT-2026-70994
The Linkable Loadable Extensions llext subsystem mis-handles PLT/RELA relocation entries when linking a relocatable partially-linked ELF extension. In llext link plt subsys/llext/llext link.c, the relocatable branch tgt != NULL, the path used for Xtensa relocatable objects computed the patch...
CVE-2026-10669
On Xtensa SoCs built with CONFIGXTENSAMPU and CONFIGUSERSPACE, archbuffervalidate in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return value to 0 access permitted a...