Kernel Vulnerability in Zephyr RTOS Affecting Thread Management

CVE-2026-78118

What is CVE-2026-78118?

In Zephyr RTOS, a flaw in the kernel's thread wait queue management can lead to critical out-of-bounds and use-after-free vulnerabilities. When multiple processors interact with the same wait queue, timing issues may arise due to improper synchronization. This can cause the kernel to mistakenly wake a thread with unchecked pointers or access invalid memory regions, leading to unpredictable behavior, including potential kernel crashes. The vulnerability particularly affects systems with multiple CPUs and could allow local malicious threads to interfere with kernel operations, making it essential for users to apply recommended updates.

References