CVE-2026-12365

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description A use-after-free issue exists in the second-generation work queue within kernel/work.c during the handling of delayable work timeouts. The problem occurs when a delayable work item's timeout is dequeued and the work timeout() handler is in flight but blocked acquiring the work-queue spinlock. In this state, a concurrent cancellation via unschedule locked() fails to wait for the handler to finish because z abort timeout() returns -EINVAL without removing the record. Consequently, cancel async locked(), k work cancel delayable sync(), and k work flush delayable() may return without blocking on the active handler.

If a caller frees the k work delayable object immediately after a successful sync cancel, a race condition occurs. The work timeout() handler then dereferences the freed record, reading to->dticks via z is timeout handler canceled(). If the memory slot is reused, it performs a read-modify-write of wp->flags (specifically K WORK DELAYED BIT) and submits work using a stale dw->queue pointer. This is a kernel-internal concurrency defect requiring an SMP build and a subsystem that schedules and frees delayable work items. An attacker influencing the timing of teardown could cause kernel memory corruption or a system crash resulting in denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.