CVE-2026-11742 zephyrproject CVE debrief

Who should care

Users of the Zephyr kernel, especially those using affected subsystems like net_buf, Bluetooth, USB, and networking, should review their deployments for potential exposure. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact on their systems and plan for mitigations or patches. The vulnerability's low severity and limited scope mean that not all users may be affected, but those with concurrent access to queue data should verify their configurations and apply patches if necessary.

Technical summary

The kernel queue helper `z_queue_node_peek()` in kernel/queue.c dereferences a node taken from a queue's data_q list without holding the queue's spinlock. This can lead to a use-after-free read when a concurrent `k_queue_get()` on the same queue frees the node between the moment peek obtains the node pointer and the moment it dereferences it. The affected subsystems include net_buf, Bluetooth, USB, and networking. The fix involves wrapping both peek implementations with `k_spin_lock/k_spin_unlock` on the queue lock, making the read-and-dereference atomic with respect to the concurrent unlink-and-free.

Defensive priority

Apply patches to prevent use-after-free vulnerability

Recommended defensive actions

• Apply patches to prevent use-after-free vulnerability
• Review and update affected subsystems
• Monitor for concurrent access to queue data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the lack of synchronization in the `z_queue_node_peek()` function, which can lead to a use-after-free read. To verify, defenders should review the Zephyr kernel's queue helper function and check for concurrent access to queue data. The fix involves wrapping the peek implementations with `k_spin_lock/k_spin_unlock` on the queue lock. However, the exact scope of affected systems and potential impact on various subsystems like net_buf, Bluetooth, USB, and networking remains limited by source detail and requires further review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.