{"id":"CVE-2026-12365","summary":"Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race","details":"A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler work_timeout() is in flight (blocked acquiring the work-queue spinlock), a concurrent cancellation does not wait for that handler to finish. In unschedule_locked() the pre-fix code called z_abort_timeout(), which for an already-announcing record returns -EINVAL without removing it; cancel_async_locked() then observes the work as idle, so even k_work_cancel_delayable_sync() and k_work_flush_delayable() return without blocking on the in-flight handler.\n\nBecause those are the APIs the kernel header documents as the safe way to cancel before freeing a k_work_delayable, a caller that frees the object immediately after a successful sync cancel can race the still-pending handler. work_timeout() subsequently dereferences the freed record: it reads to-\u003edticks via z_is_timeout_handler_canceled() and, if the freed slot has been reused so the bail check fails, performs a read-modify-write of wp-\u003eflags (K_WORK_DELAYED_BIT) and submits work against a stale dw-\u003equeue pointer — a use-after-free read and write.\n\nThe k_work API is kernel-mode only (no __syscall entry point), so this is a kernel-internal concurrency defect rather than a userspace privilege escalation. Triggering it requires an SMP build and a subsystem that schedules and then frees (or reschedules) a delayable work item in the narrow window while its timeout is announcing; an attacker able to influence the timing of such teardown (for example via connection churn driving subsystem timers) has a plausible but probabilistic path. The impact is kernel memory corruption or crash (denial of service).\n\nThe fix makes unschedule_locked() wait, by spinning on z_try_abort_timeout() returning -EAGAIN while releasing and re-acquiring the work spinlock, until any in-flight handler completes before returning, and switches work_timeout() to atomic K_WORK_DELAYED_BIT ownership. This closes both the free-then-handler use-after-free and the related reschedule early-fire race.","aliases":["GHSA-rhmh-r93p-6g99"],"modified":"2026-08-17T04:19:21.591567Z","published":"2026-08-14T17:52:05.922Z","database_specific":{"cna_assigner":"zephyr","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12365.json","unresolved_ranges":[{"extracted_events":[{"introduced":"2.6.0"},{"fixed":"4.5.0"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12365.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rhmh-r93p-6g99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12365"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"0"},{"fixed":"59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.7.99","v2.7.0-rc3","v2.7.0-rc2","v2.7.0-rc1","zephyr-v2.6.0","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","zephyr-v2.5.0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","zephyr-v2.4.0","v2.4.0","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","zephyr-v2.3.0","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","zephyr-v2.1.0","v2.1.0","zephyr-v2.2.0","v2.2.0","v2.2.0-rc3","v2.2.0-rc2","v2.2.0-rc1","v2.1.0-rc3","v2.1.0-rc2","v2.1.0-rc1","zephyr-v2.0.0","v2.0.0","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","zephyr-v1.14.0","v1.14.0","v1.14.0-rc3","v1.14.0-rc2","v1.14.0-rc1","zephyr-v1.13.0","v1.13.0","v1.13.0-rc3","v1.13.0-rc2","v1.13.0-rc1","zephyr-v1.12.0","v1.12.0","v1.12.0-rc3","v1.12.0-rc2","v1.12.0-rc1","zephyr-v1.11.0","v1.11.0","v1.11.0-rc3","v1.11.0-rc2","v1.11.0-rc1","zephyr-v1.10.0","v1.10.0","v1.10.0-rc3","v1.10.0-rc2","v1.10.0-rc1","zephyr-v1.9.0","v1.9.0","v1.9.0-rc4","v1.9.0-rc3","v1.9.0-rc2","v1.9.0-rc1","v1.8.99","zephyr-v1.5.0","v1.5.0","v1.7.99","v1.6.99","v1.5.0-rc4","v1.5.0-rc3","v1.5.0-rc2","v1.5.0-rc1","v1.5.0-rc0","zephyr-v1.4.0","v1.4.0","v1.4.0-rc3","v1.4.0-rc2","v1.4.0-rc1","zephyr-v1.3.0","v1.3.0","v1.3.0-rc2","v1.3.0-rc1","zephyr-v1.2.0","v1.2.0","v1.2.0-rc2","v1.2.0-rc1","zephyr-v1.1.0","v1.1.0","v1.1.0-rc1","zephyr-v1.0.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12365.json","vanir_signatures_modified":"2026-08-17T04:19:21Z","vanir_signatures":[{"digest":{"function_hash":"239513898230447693595527634661069693347","length":156},"id":"CVE-2026-12365-16d6a618","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c","function":"work_timeout_stop_locked"},"deprecated":false},{"id":"CVE-2026-12365-64f04d42","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c","function":"k_work_cancel_delayable"},"deprecated":false,"digest":{"function_hash":"172121697861166700260592906013976680749","length":277}},{"id":"CVE-2026-12365-7a345fb5","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c"},"deprecated":false,"digest":{"line_hashes":["153252386360707382122943946168968935484","14945460685538635617202583622091037950","222450818200792738686926169987372603133","60310941802114192154400693254874558037","3311096056985230901305908416586872828","134265437625658522055519990937916721050","235799040848523767820221550909131193331","113782974449414870853076195543596158385","327362131811284887319074582453417665738","250679015642867065828296475475286705284","98482576484949277183347694801165533341","85587674057586761129289779368926988173","215527244398505535555567111796605830539","158496292113580141277511198244215048192","294240891016785804688398046880576833140","118842441736677874782677716639890985142","103325567323812144711643995688869377751","42006986859820528918393338524064021305","141095510433998880204190810469268345609","167043705863497753309791449002584135708","316825439507825814815486937800197892261","127530071429309885523423455827625133742","204620381197802286533416171113291986967","147369670199073416710185887020037594837","190212958576676880957664987562094834369","133824768821220846076791466302086070572","161248145768812645150615844927516957594","147366721543430479604789414554614440474","240055010205243426485230699961647267536","128659801050106802873904080163418427323","70267715171331729549223918194643505104","258930787314423154143386549478580263412","59924159137676869987363159757717912044","85522175002250808261875769273193209709","188699310775192540206410397219466396308","129564479977005374929254370263738586719","270161943590929953158725217226605412813","292221025264386900923105211803097591701","61242962605232588691349497255666757217","13344968681156544665356486728807324456","107575772146488941597624444080080499544","105954788662828894202640895141100925714","318499512772148308829879793803665950687","133300684305341710046322746939371632689","49280687460033302660152003668981855924","272230741457859913814868391715381306807"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c","function":"work_timeout_handler"},"deprecated":false,"digest":{"function_hash":"258201184071671259821934925216118482072","length":661},"id":"CVE-2026-12365-834722eb","signature_type":"Function"},{"id":"CVE-2026-12365-8cd92878","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c","function":"k_work_cancel_delayable_sync"},"deprecated":false,"digest":{"function_hash":"191972899073794895545644972039635149263","length":687}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c","function":"work_timeout"},"deprecated":false,"digest":{"function_hash":"10469933923685389090977516538083765261","length":429},"id":"CVE-2026-12365-a4267f55"},{"deprecated":false,"digest":{"function_hash":"116220373502602691633287967549970527949","length":219},"id":"CVE-2026-12365-c8877506","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c","function":"unschedule_locked"}},{"deprecated":false,"digest":{"length":431,"function_hash":"224766034729847320031736624228039935968"},"id":"CVE-2026-12365-d20a28e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c","function":"k_work_reschedule_for_queue"}},{"deprecated":false,"digest":{"function_hash":"145963565011887590591373571851832691182","length":112},"id":"CVE-2026-12365-e2112992","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c","function":"cancel_delayable_async_locked"}},{"deprecated":false,"digest":{"function_hash":"231058846873810732103531597566061026716","length":828},"id":"CVE-2026-12365-f3000354","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7","target":{"file":"kernel/work.c","function":"k_work_flush_delayable"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H"}]}