CVE-2026-78118: race in zephyrproject zephyr

The vulnerability exists in the Zephyr kernel's z_waitq_head() helper, which reads the head of a thread wait queue without holding the scheduler spinlock (_sched_spinlock) that serializes wait-queue mutations on SMP systems. The problematic call site is z_timer_expiration_handler(), which holds only the timer subsystem lock (timer_lock) while accessing timer->wait_q and manipulating threads. Concurrent removal of the last waiter on another CPU can cause sys_dlist_peek_head() to return invalid pointers, such as the list sentinel or freed thread objects. Subsequent calls to unpend_thread_no_timeout() and arch_thread_return_value_set() then perform unsafe memory operations, resulting in out-of-bounds and use-after-free writes in supervisor context and scheduler corruption. The race can be triggered by unprivileged user-mode threads via system calls like k_timer_start(), k_timer_status_sync(), k_thread_create(), and k_thread_abort(). Exploitation is constrained by the need for multi-CPU builds (CONFIG_MP_MAX_NUM_CPUS > 1) and a narrow timing window, typically causing kernel crashes rather than controlled corruption. The fix involves splitting z_waitq_head() into a locked variant and ensuring the timer expiration handler's operations occur under a single scheduler spinlock region.

Successful exploitation can lead to out-of-bounds and use-after-free writes in kernel supervisor context, causing scheduler state corruption or kernel crashes. The vulnerability allows an unprivileged local user-mode thread to race against kernel data structures, potentially destabilizing the system. However, exploitation requires multi-CPU hardware and precise timing, making controlled exploitation difficult. The CVSS score of 7.0 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves modifying the kernel code to properly acquire the scheduler spinlock when accessing wait queues and consolidating timer expiration handler operations under this lock. Until an official patch is available, avoid running untrusted local code on multi-CPU Zephyr systems or disable multi-CPU support if feasible.