Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-78118— Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

内核辅助函数 （位于 ）用于读取线程等待队列的头部。但在对称多处理（SMP）系统上，该函数在多个调用点被调用时，并未持有用于序列化等待队列修改操作的调度器自旋锁 。其中关键的调用点位于 中的 ：该函数在读取 并随后执行取消挂起（unpending）、设置返回值以及准备（ready）所获取的线程时，仅持有了定时器子系统的锁 。另一方面， 中的 在仅持有 的情况下，将已中止的线程从其等待队列中移除。因此，这两条执行路径并非互斥，存在竞态条件。 当上述时间窗口内，另一 CPU 移除了最后一个等待者时， 可能返回列表哨兵（

CVSS 7.0 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 2.2.0< 4.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-78118

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP
Source: CVE Program / CVE List V5
Vulnerability Description
The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive. When the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer. The result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data. Exploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() that acquires it, and brings the timer expiration handler's head read, unpend and ready under a single LOCK_SCHED_SPINLOCK region.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 2.2.0 ~ 4.5.0 -

II. Public POCs for CVE-2026-78118

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78118

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-78118 (1)

Vendor Advisories for CVE-2026-78118 (1)

Same Patch Batch · zephyrproject · 2026-10-21 · 8 CVEs total

CVE-2026-19676 7.8 HIGH PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing a
CVE-2026-79976 7.1 HIGH NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C con
CVE-2026-78119 6.3 MEDIUM Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an un
CVE-2026-19947 5.3 MEDIUM Missing kernel object permission check in devmux syscalls allows unprivileged user threads
CVE-2026-78116 5.2 MEDIUM Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation e
CVE-2026-78117 4.2 MEDIUM Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver c
CVE-2026-18748 3.5 LOW Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-362

V. Comments for CVE-2026-78118

No comments yet

Leave a comment