CVE-2026-11742

Name of the Vulnerable Software and Affected Versions Zephyr RTOS (affected versions not specified)

Description A use-after-free read exists in the kernel queue helper z queue node peek() within kernel/queue.c. The functions z impl k queue peek head() and z impl k queue peek tail() perform a read-and-dereference of a node from a queue's data q list without holding the required spinlock. In contrast, other accessors like k queue get() operate under this lock to unlink and free the alloc node structure.

On SMP builds or under preemption/ISR concurrency, a concurrent call to k queue get() can free a node after z queue node peek() has obtained the pointer but before it is dereferenced. This allows the system to read flag bits and data pointers from freed or re-allocated heap memory, returning a dangling pointer. This issue affects k fifo and k lifo wrappers, impacting the net buf, Bluetooth, USB, and networking subsystems, and is reachable via system calls from CONFIG USERSPACE threads. This can lead to the leakage of stale heap contents, system crashes, or memory corruption.

Recommendations Update the software to a version where z impl k queue peek head() and z impl k queue peek tail() are wrapped with k spin lock() and k spin unlock() to ensure atomic operations.