CVE-2026-78118 zephyrproject CVE debrief

Who should care

System administrators and developers using Zephyr versions 2.2.0 up to but not including 4.5.0 should assess their exposure and apply the patch or update to a fixed version. They should also review system logs for potential exploitation attempts and prioritize patching or updating to a fixed version.

Why it matters

A race condition in the Zephyr kernel's wait queue implementation can lead to stale or sentinel thread pointers being returned in the timer expiration handler, potentially causing issues with thread synchronization. Defenders should verify if their Zephyr-based systems are using affected versions and prioritize patching or updating to a fixed version.

• Defenders should verify if their Zephyr-based systems are using affected versions and prioritize patching or updating to a fixed version.
• System administrators should monitor system logs for potential exploitation attempts.
• Developers should review and apply the patch provided by the vendor.

Technical summary

The `z_waitq_head()` function in the Zephyr kernel reads the head of a thread wait queue without holding the scheduler spinlock `_sched_spinlock` on SMP systems. This can lead to a stale or sentinel thread pointer being returned in the timer expiration handler, potentially causing issues with thread synchronization. The issue arises from the lack of synchronization between the timer expiration handler and the `halt_thread()` function, which can remove an aborted thread from its wait queue while holding only `_sched_spinlock`. As a result, the timer expiration handler may return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch provided by the vendor
• Update to Zephyr version 4.5.0 or later
• Monitor system logs for potential exploitation attempts
• Perform a thorough review of system configurations and Zephyr versions in use
• Verify the integrity of affected systems
• Check for any existing mitigations or workarounds
• Review and apply any additional security patches

Evidence notes

The CVE record and source item provide details on the vulnerability. The NVD entry is currently being processed. Defenders should verify if their Zephyr-based systems are using affected versions and prioritize patching or updating to a fixed version. The vulnerability affects Zephyr versions 2.2.0 up to but not including 4.5.0. There is no information on public exploitation attempts. The source item and CVE Program record provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.