Concurrency Issue in Kernel Queue Handling in Zephyr RTOS by Nordic Semiconductor

CVE-2026-11742

What is CVE-2026-11742?

A concurrency flaw in the kernel queue handling functions of Zephyr RTOS can lead to a use-after-free condition. The function z_queue_node_peek() improperly accesses nodes from a queue without the necessary spinlock synchronization. This results in potential dereferencing of freed memory, risking system crashes or memory corruption. Malicious actors can exploit this vulnerability during concurrent access operations, allowing them to expose stale data or cause unintended behaviors within the system.

References