CVE-2026-12366

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description A use-after-free issue exists in the dynamic kernel-object disposal path unref check() within kernel/userspace/userspace.c. The system frees an object's storage using k free(dyn->data) when its reference count reaches zero, but the cleanup process fails to handle the K OBJ TIMER case. Consequently, a dynamically-allocated and armed k timer remains linked in the global timeout queue timeout q after its storage is freed, creating a dangling node.

When the timer expires, the system invokes z timer expiration handler() on the freed node, leading to memory corruption in the kernel/ISR context. This flaw is reachable by an unprivileged user thread when CONFIG USERSPACE and CONFIG DYNAMIC OBJECTS are enabled. An attacker can trigger this by arming a timer via the k timer start() syscall and then releasing the last permission via the k object release() syscall or by exiting the thread through k thread perms all clear(). This can be used as a sandbox-escape primitive for privilege escalation.

Recommendations Implement the k timer cleanup() function to cancel the timeout and wait for any in-flight handlers, ensuring it is called for K OBJ TIMER before the object storage is freed.