CVE-2026-12365 zephyrproject CVE debrief

Who should care

Organizations using Zephyr should be aware of this vulnerability and take steps to patch it. The vulnerability has a CVSS score of 5.8 and is classified as MEDIUM severity. Organizations should prioritize patching this vulnerability to prevent potential kernel crashes or memory corruption. Zephyr users should review and update their configurations to ensure the fix is properly implemented and monitor system logs for potential crashes or memory corruption issues. Security teams should track exceptions and retest remediated assets to ensure the vulnerability is properly mitigated. Operators and platform administrators should be aware of the potential impact on their systems and take steps to mitigate the vulnerability. Vulnerability management teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Asset inventory and change management processes should be updated to reflect the patching and mitigation efforts. Compensating controls, such as monitoring and detection, should be reviewed and updated to ensure they are effective in detecting and preventing exploitation of the vulnerability. Rollback and change window processes should be updated to ensure that patches are properly applied and verified. Source tracking and incident response plans should be updated to reflect the potential impact of the vulnerability.  Defensive actions should be taken to prevent exploitation of the vulnerability, including applying patches, reviewing and updating configurations, and monitoring system logs.  Defenders should verify that the fix is properly implemented and that systems are not vulnerable to exploitation.  Security teams should review and update their incident response plans to reflect the potential impact of the vulnerability.  Organizations should prioritize patching this vulnerability to prevent potential kernel crashes or memory corruption.  Zephyr users should review and update their configurations to ensure the fix is properly implemented and monitor system logs for potential crashes or memory corruption issues.  Security teams should track exceptions and retest remediated assets to ensure the  vull.

Technical summary

The vulnerability exists in the Zephyr second-generation work queue, specifically in the handling of delayable work timeouts. A use-after-free error occurs when a delayable work item's timeout has been dequeued and its handler work_timeout() is in flight, and a concurrent cancellation does not wait for that handler to finish. This can lead to kernel memory corruption or crash. The fix makes unschedule_locked() wait, by spinning on z_try_abort_timeout() returning -EAGAIN while releasing and re-acquiring the work spinlock, until any in-flight handler completes before returning.

Defensive priority

Organizations using Zephyr should prioritize patching this vulnerability to prevent potential kernel crashes or memory corruption.

Recommended defensive actions

• Apply the patch provided by the Zephyr project to fix the use-after-free vulnerability
• Review and update Zephyr configurations to ensure the fix is properly implemented
• Monitor system logs for potential crashes or memory corruption issues
• Track exceptions and retest remediated assets to ensure the vulnerability is properly mitigated
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a use-after-free error in the Zephyr second-generation work queue. When a delayable work item's timeout has been dequeued and its handler work_timeout() is in flight, a concurrent cancellation does not wait for that handler to finish. This can lead to kernel memory corruption or crash. Organizations should verify their Zephyr configurations and ensure that the fix is properly implemented. Defenders should review system logs for potential crashes or memory corruption issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.