This vulnerability exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout handler is in progress and a concurrent cancellation occurs, the cancellation does not wait for the handler to complete. This can lead to a use-after-free condition where the handler dereferences freed memory, causing kernel memory corruption or crash. The issue requires SMP builds and specific timing to trigger. The fix involves making the cancellation wait for the handler to finish and switching to atomic ownership of the delayed work bit, preventing the race conditions.

The vulnerability can cause kernel memory corruption or a denial of service (kernel crash). It does not provide a path for userspace privilege escalation since the affected API is kernel-mode only. Exploitation requires specific timing and concurrency conditions in SMP builds, making it a probabilistic attack vector rather than a straightforward exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves changes to the kernel work queue code to wait for in-flight handlers before cancellation completes and to use atomic ownership flags. Until an official fix is released, users should avoid scenarios that trigger concurrent cancellation and freeing of delayable work items in SMP environments.