CVE-2026-12366: use-after-free in zephyrproject zephyr
Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only K_OBJ_MSGQ and K_OBJ_STACK; there was no K_OBJ_TIMER case. A dynamically-allocated, initialized, and armed k_timer keeps its embedded struct _timeout dnode linked in the global timeout queue (_timeout_q), so freeing the timer storage without cancelling the timeout leaves a dangling node in that queue. When the timer next expires, the timeout machinery walks _timeout_q and invokes z_timer_expiration_handler() on the freed node, dereferencing and writing freed (and reusable) kernel heap in kernel/ISR context. This is a deterministic use-after-free that does not depend on SMP: the queued node is simply never unlinked at free time. The disposal is reachable from an unprivileged user thread under CONFIG_USERSPACE + CONFIG_DYNAMIC_OBJECTS: a thread that holds the last permission on such a timer drops it via the k_object_release() syscall (or by exiting, through k_thread_perms_all_clear()), and can arm the timer itself via the k_timer_start() syscall. The free and the expiration handler run at kernel privilege while the actor is a user thread, so the bug is a sandbox-escape memory-corruption primitive usable for privilege escalation. The fix adds k_timer_cleanup() (cancel the timeout and wait for any in-flight handler) and calls it for K_OBJ_TIMER before freeing.
AI Analysis
Technical Summary
The vulnerability arises in Zephyr's kernel/userspace/userspace.c unref_check() function, which frees kernel objects when their reference count reaches zero. The cleanup switch statement handles only message queue and stack objects but omits timer objects (K_OBJ_TIMER). Dynamically allocated and armed timers maintain a linked node in the global timeout queue. Freeing the timer without cancelling the timeout leaves a dangling node. When the timer expires, the kernel's timeout handler accesses freed memory, causing a deterministic use-after-free in kernel interrupt context. This can be exploited by an unprivileged user thread with the last permission on the timer object, enabling privilege escalation. The fix involves adding a k_timer_cleanup() function to cancel timeouts and wait for handlers before freeing timer objects.
Potential Impact
This vulnerability allows an unprivileged user thread to cause a use-after-free in kernel memory, leading to memory corruption in interrupt context. The corruption can be exploited to escape sandbox restrictions and escalate privileges to kernel level. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor's fix adds a k_timer_cleanup() function that cancels timeouts and waits for in-flight handlers before freeing timer objects. Until an official fix is available, avoid running untrusted user threads with permissions to create and release timer objects dynamically.
CVE-2026-12366: use-after-free in zephyrproject zephyr
Description
Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only K_OBJ_MSGQ and K_OBJ_STACK; there was no K_OBJ_TIMER case. A dynamically-allocated, initialized, and armed k_timer keeps its embedded struct _timeout dnode linked in the global timeout queue (_timeout_q), so freeing the timer storage without cancelling the timeout leaves a dangling node in that queue. When the timer next expires, the timeout machinery walks _timeout_q and invokes z_timer_expiration_handler() on the freed node, dereferencing and writing freed (and reusable) kernel heap in kernel/ISR context. This is a deterministic use-after-free that does not depend on SMP: the queued node is simply never unlinked at free time. The disposal is reachable from an unprivileged user thread under CONFIG_USERSPACE + CONFIG_DYNAMIC_OBJECTS: a thread that holds the last permission on such a timer drops it via the k_object_release() syscall (or by exiting, through k_thread_perms_all_clear()), and can arm the timer itself via the k_timer_start() syscall. The free and the expiration handler run at kernel privilege while the actor is a user thread, so the bug is a sandbox-escape memory-corruption primitive usable for privilege escalation. The fix adds k_timer_cleanup() (cancel the timeout and wait for any in-flight handler) and calls it for K_OBJ_TIMER before freeing.
CVSS v3.1
Score 8.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises in Zephyr's kernel/userspace/userspace.c unref_check() function, which frees kernel objects when their reference count reaches zero. The cleanup switch statement handles only message queue and stack objects but omits timer objects (K_OBJ_TIMER). Dynamically allocated and armed timers maintain a linked node in the global timeout queue. Freeing the timer without cancelling the timeout leaves a dangling node. When the timer expires, the kernel's timeout handler accesses freed memory, causing a deterministic use-after-free in kernel interrupt context. This can be exploited by an unprivileged user thread with the last permission on the timer object, enabling privilege escalation. The fix involves adding a k_timer_cleanup() function to cancel timeouts and wait for handlers before freeing timer objects.
Potential Impact
This vulnerability allows an unprivileged user thread to cause a use-after-free in kernel memory, leading to memory corruption in interrupt context. The corruption can be exploited to escape sandbox restrictions and escalate privileges to kernel level. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor's fix adds a k_timer_cleanup() function that cancels timeouts and waits for in-flight handlers before freeing timer objects. Until an official fix is available, avoid running untrusted user threads with permissions to create and release timer objects dynamically.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-16T03:53:46.485Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7f5a78bf8831d539821045
Added to database: 08/14/2026, 18:12:08 UTC
Last enriched: 08/14/2026, 18:27:37 UTC
Last updated: 08/15/2026, 00:11:14 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.