CVE-2026-78118

Name of the Vulnerable Software and Affected Versions Zephyr RTOS (affected versions not specified)

Description On SMP systems, the kernel helper z waitq head() reads the head of a thread wait queue without holding the sched spinlock scheduler spinlock, which is required to serialize wait-queue mutation. This occurs specifically in z timer expiration handler() within kernel/timer.c, which only holds the timer lock while accessing timer->wait q. Because halt thread() in kernel/sched.c removes threads using only the sched spinlock, these two execution paths are not mutually exclusive.

This race condition can lead to sys dlist peek head() returning a list sentinel or a pointer to a thread that has already been freed or unpended. Subsequently, unpend thread no timeout() and arch thread return value set() may perform out-of-bounds and use-after-free writes in supervisor context, resulting in scheduler state corruption or a kernel crash. An unprivileged user-mode thread can trigger this race using system calls such as k timer start(), k timer status sync(), k thread create(), and k thread abort(). Exploitation requires a multi-CPU build where CONFIG MP MAX NUM CPUS is greater than one and local code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.