Dynamic Kernel-Object Disposal Vulnerability in Zephyr by Zephyr Project

CVE-2026-12366

What is CVE-2026-12366?

A critical flaw in Zephyr's dynamic kernel-object disposal, specifically during the unref_check() process, allows for a use-after-free condition. When a timer object, which has been dynamically allocated and armed, is freed while leaving its associated timeout node in the global timeout queue intact, it introduces a risk. The subsequent invocation of the expiration handler on this now-freed node leads to memory corruption and can serve as a route for privilege escalation from unprivileged user threads. The recent fix involves ensuring proper cleanup of timers to prevent this issue.

References