Alexandre Joannou | Searcharxiv

arXiv2026

CHERI-D: Secure and efficient inline object ID for CHERI temporal memory safety

We propose CHERI-D, an architectural extension to CHERI that supports efficient temporal memory safety. Efficient memory safety is an increasing priority for programming languages, operating systems, and hardware designs, and CHERI is a leading hardware/software system that provides native spatial safety and a foundation for temporal memory safety. Due to CHERI lacking intrinsic architectural support for temporal memory safety, the state-of-the-art CHERI temporal safety solution, Cornucopia Reloaded, is a software-based solution that provides use-after-reallocation (UAR) protections instead of the stronger use-after-free (UAF) mitigation, and suffers performance overhead due to delayed reallocation and revocation. CHERI-D associates object identification (ID) metadata with capability pointers to provide temporal integrity of allocations. CHERI spatial safety allows CHERI-D to store object IDs safely inline with allocation data, potentially within unused fragmentation. Evaluated in simulation and in hardware, CHERI-D significantly reduces the revocation overhead of Cornucopia Reloaded while allowing it to support strict use-after-free mitigation.

cs.AR↗

arXiv2026

PoisonCap: Efficient Hierarchical Temporal Safety for CHERI

In this paper, we present PoisonCap: scalable temporal safety with strict use-after-free protection and initialisation safety for CHERI systems. Efficient memory safety is an increasing priority for programming languages, operating systems, and hardware designs, and CHERI is a leading hardware/software system that provides native spatial safety and a foundation for temporal memory safety. Cornucopia Reloaded, the current state-of-the-art CHERI temporal safety solution, provides use-after-reallocation safety instead of stronger use-after-free safety, and is not able to enforce initialisation safety. We show that a new 'poison' capability format can be used to enforce strict use-after-free and initialisation safety, and also to communicate memory state to the microarchitecture for efficient cache management of quarantined memory. We enable elegant delegation of memory poisoning privilege using capability bounds to allow nested allocators to enforce safety on their consumers without disturbing upstream allocators. PoisonCap can replace the Cornucopia shadow bitmap, and also automatically zeros memory on reallocation, or optionally traps on read-before-write to enforce initialisation safety. As a result, it incurs no fundamental overhead relative to a Cornucopia baseline that zeros before reallocation, strengthening CHERI temporal safety without performance overhead.

cs.AR↗