Use-after-free Vulnerability in Zephyr Kernel Work Queue by Zephyr Project

CVE-2026-12365

What is CVE-2026-12365?

A use-after-free vulnerability has been identified within the Zephyr kernel's second-generation work queue, specifically in the handling of delayable work timeouts. This flaw arises when a delayable work item’s timeout is dequeued while its handler is executing, potentially leading to a race condition. If a concurrent cancellation initiates while the handler is still in process, the system may not manage the timeout correctly, leaving the work item in an inconsistent state. This can lead to kernel memory corruption or a crash, resulting in denial of service. The resolution implemented involves ensuring that the cancellation process waits for any running handler to complete before returning, effectively safeguarding against both the use-after-free scenario and the associated race condition.

References