CVE-2026-12366 zephyrproject CVE debrief

Who should care

Users of Zephyr with CONFIG_USERSPACE + CONFIG_DYNAMIC_OBJECTS enabled should apply remediation to prevent privilege escalation via this use-after-free vulnerability. System administrators, security teams, and developers working with Zephyr should review the vulnerability details and ensure that affected systems are identified and patched. Additionally, operators and maintainers of systems using Zephyr should be aware of the potential impact and take steps to mitigate the vulnerability until a fix is applied.

Technical summary

The Zephyr dynamic kernel-object disposal path has a use-after-free vulnerability. When a dynamically-allocated, initialized, and armed k_timer is freed without cancelling its timeout, a dangling node remains in the global timeout queue. Upon timer expiration, the timeout machinery invokes z_timer_expiration_handler() on the freed node, causing a deterministic use-after-free that allows an unprivileged user thread to escalate privileges. This vulnerability is particularly severe as it enables a sandbox-escape memory-corruption primitive, which can be used for privilege escalation.

Defensive priority

This use-after-free vulnerability in Zephyr's dynamic kernel-object disposal path allows an unprivileged user thread to escalate privileges via a sandbox-escape memory-corruption primitive. Apply vendor remediation and monitor for compensating controls.

Recommended defensive actions

• Apply vendor remediation for Zephyr's dynamic kernel-object disposal path vulnerability
• Monitor for compensating controls to prevent privilege escalation
• Perform inventory checks for affected Zephyr versions and configurations
• Implement exception tracking for suspicious kernel-object disposal activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE and NVD records provide details on the vulnerability. Evidence is based on official CVE Program and NVD sources. Limited source detail exists; verify affected scope and apply compensating controls. Affected product deployments should be reviewed for Zephyr with CONFIG_USERSPACE + CONFIG_DYNAMIC_OBJECTS enabled. Defenders should verify system configurations, monitor for suspicious activity, and ensure timely application of vendor remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.