{"id":"CVE-2026-78118","summary":"Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP","details":"The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer-\u003ewait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive.\n\nWhen the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer.\n\nThe result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data.\n\nExploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() that acquires it, and brings the timer expiration handler's head read, unpend and ready under a single LOCK_SCHED_SPINLOCK region.","aliases":["GHSA-gm6w-pv43-m3vf"],"modified":"2026-10-22T07:21:15.598174543Z","published":"2026-10-21T18:19:32.200Z","database_specific":{"cwe_ids":["CWE-362"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78118.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"2.2.0"},{"fixed":"4.5.0"}]}]}],"cna_assigner":"zephyr"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78118.json"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gm6w-pv43-m3vf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78118"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"0"},{"fixed":"a9b21fb354e8468dd15db307c3e599dc68b7ef33"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"a9b21fb354e8468dd15db307c3e599dc68b7ef33"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.7.99","v2.7.0-rc3","v2.7.0-rc2","v2.7.0-rc1","zephyr-v2.6.0","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","zephyr-v2.5.0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","zephyr-v2.4.0","v2.4.0","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","zephyr-v2.3.0","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","zephyr-v2.1.0","v2.1.0","zephyr-v2.2.0","v2.2.0","v2.2.0-rc3","v2.2.0-rc2","v2.2.0-rc1","v2.1.0-rc3","v2.1.0-rc2","v2.1.0-rc1","zephyr-v2.0.0","v2.0.0","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","zephyr-v1.14.0","v1.14.0","v1.14.0-rc3","v1.14.0-rc2","v1.14.0-rc1","zephyr-v1.13.0","v1.13.0","v1.13.0-rc3","v1.13.0-rc2","v1.13.0-rc1","zephyr-v1.12.0","v1.12.0","v1.12.0-rc3","v1.12.0-rc2","v1.12.0-rc1","zephyr-v1.11.0","v1.11.0","v1.11.0-rc3","v1.11.0-rc2","v1.11.0-rc1","zephyr-v1.10.0","v1.10.0","v1.10.0-rc3","v1.10.0-rc2","v1.10.0-rc1","zephyr-v1.9.0","v1.9.0","v1.9.0-rc4","v1.9.0-rc3","v1.9.0-rc2","v1.9.0-rc1","v1.8.99","zephyr-v1.5.0","v1.5.0","v1.7.99","v1.6.99","v1.5.0-rc4","v1.5.0-rc3","v1.5.0-rc2","v1.5.0-rc1","v1.5.0-rc0","zephyr-v1.4.0","v1.4.0","v1.4.0-rc3","v1.4.0-rc2","v1.4.0-rc1","zephyr-v1.3.0","v1.3.0","v1.3.0-rc2","v1.3.0-rc1","zephyr-v1.2.0","v1.2.0","v1.2.0-rc2","v1.2.0-rc1","zephyr-v1.1.0","v1.1.0","v1.1.0-rc1","zephyr-v1.0.0","v1.0.0"],"database_specific":{"vanir_signatures_modified":"2026-10-22T07:21:15Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78118.json","vanir_signatures":[{"id":"CVE-2026-78118-009b37ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/userspace/userspace.c","function":"unref_check"},"deprecated":false,"digest":{"function_hash":"253233798720056269051366703268357488952","length":996}},{"target":{"file":"kernel/stack.c"},"deprecated":false,"digest":{"line_hashes":["230956542754992470005590213882443644968","313094644964595346876504586741043855696","306401905976573215431098741695924204020","288132748974578799349738332916232953686","206878136099227429227530392311072955152","302309212883246005150476475566092955236","253428894179137444025661420498172680263","47772974190076095174672150095242215123","159377944429679060589075023981362166264","66145034221438484827598553684430146005","190585968547092395146396895059281117454","40800659499644807269369510603127974177","207927782905877832031434342881710257315","9770312928309931749137253378375994050","209003662660347400533140060371739452573","307754327507593290279488423731904701550","158937699821319517309971989720470568306","1928962195325020258458036102611359099","231559616425347338373107223811118260570","283157027877877431260235099309594251921","249767370381025212975408046730283110795"],"threshold":0.9},"id":"CVE-2026-78118-25fb9175","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33"},{"digest":{"length":358,"function_hash":"195576453635795299972175367447659090341"},"id":"CVE-2026-78118-269ad171","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"function":"k_thread_perms_clear","file":"kernel/userspace/userspace.c"},"deprecated":false},{"digest":{"line_hashes":["291298499856443943080380415216710731329","37483347422301404901575007076023046275","326633752813922983537566219245844846004","61143559679606377711289611581465058063","209244077265229697880913199791665280013","279619295308435291151376752369862867709","88101223765963818816286070050968206002","261342441636594500200804858091805851828","275837753848589670066958013791842915292","15600262011477306482481590395959657462"],"threshold":0.9},"id":"CVE-2026-78118-295f8ebc","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/sched.c"},"deprecated":false},{"id":"CVE-2026-78118-2d168d52","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/mutex.c"},"deprecated":false,"digest":{"line_hashes":["134116075192707497407413576526439893974","198316712993623884316711052771508383289","115824512592898030891891941067908243354","158631799057137655070878640199311663792"],"threshold":0.9}},{"digest":{"threshold":0.9,"line_hashes":["130787472691517129637480926179370912216","14964335042154446983051560163741592424","83762162753121534720841511933675613800","194609561137875983599186827931964686119","153303669653869836344712728454426343292","139141565623184975410949349764660551742","14359719305555516581898562468708371273","336876064203517262123290420992140422594","212582457600779964399473646430566587224","45690399741147502372263027234848193564","193843241415186423917210253599625253045","129875880980866891167837682228390018685"]},"id":"CVE-2026-78118-46d3e05f","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/msg_q.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/userspace/userspace.c"},"deprecated":false,"digest":{"line_hashes":["10715709629819763455139022513134418048","88551363286323266911067479112099797899","55657780939027453832543812386601699434","207868509829313814181988931860309244253","292934044678755762921313223892648018622","169510801571093686550790908841734434060","13594094396507611719873877624173368953","271343662911534031118015876687330932239","89965373827429781300834761315040966609","89269969695946863028159434069615452924","127306674045452790572486025028777704048","326631817517170363707970347514953591208","83500021262888392174271882294344111324","264669539577777519066171056136582193928","163153566256818349458494949316310746936","111722999866404272679060984639802158604","265414019505591844268716308620107891810","175848409453815881175249465133628789321","276788198250679715381668006821519225327","225846099998833891396455218462291389628","80697508569864096779307479506718883799","162317893457539573190099942108053020078","29706006113122494887700720831389050438","82898189036657310313535186111982396299","119672771320277413406213301969762472980","303653328546284501823617772390616052136","13002678900735768907469591000750130713","272838968988210227310710669393887498479","128949828658695483380472552427915883017","230490725144862614152753009617969747488","14272361925567528489007241990438417835","302682896320600652607401913330564830151","159704671041696664579320411244693802175","3974652378957403453413726013051489755","29442543299505280471361700423907386925","200925757616808718109502268005649847744","131553572187702152915603429798411808631","15916980645212785627855684858215648083","308209115864547695692098157074858907713","5574809832923007205862619594409866537","233410294646912923544298665301508733814","46306841700287388266889421813574787812","89993857878714000961925497784676172576","244940037932406799744967611901811595292"],"threshold":0.9},"id":"CVE-2026-78118-4d2e1ab4","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/stack.c","function":"k_stack_cleanup"},"deprecated":false,"digest":{"length":537,"function_hash":"273299946393115485919719637805428629475"},"id":"CVE-2026-78118-697a7691","signature_type":"Function"},{"digest":{"function_hash":"168379311740502004769327088311042505655","length":149},"id":"CVE-2026-78118-849e52ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"function":"k_thread_perms_all_clear","file":"kernel/userspace/userspace.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"function":"k_msgq_cleanup","file":"kernel/msg_q.c"},"deprecated":false,"digest":{"length":455,"function_hash":"71306542560218411460479701475022440420"},"id":"CVE-2026-78118-9d1cc452"},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/include/wait_q.h"},"deprecated":false,"digest":{"line_hashes":["327702089576140952745386466647261766291","62445717254296447225892392877810759384","212378427520180428016283556488144685501","24174071459769719917039554255252472184","107218728722272118925357629759032180917","123183609285777206241248442905113281604","98779540039428168147526718314500697796","215585365620937788961670706583768938010","46387747233683354495333177387209857686","308574413610636647155140343112257434816","140753536118464114198421213601334507427","231286548640357298508563067692911410735","278771669535266474062339383156805052243","247123604177423670311074722833052337624","38144265829549042543240073610638464611","249195849472531244401400249168833907691"],"threshold":0.9},"id":"CVE-2026-78118-9d3b5a69","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"function":"z_timer_expiration_handler","file":"kernel/timer.c"},"deprecated":false,"digest":{"function_hash":"293901950504434416314691383523705652719","length":1136},"id":"CVE-2026-78118-b704a522"},{"digest":{"function_hash":"256548138319842346789438837612542993182","length":521},"id":"CVE-2026-78118-dea16070","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/timer.c","function":"k_timer_cleanup"},"deprecated":false},{"id":"CVE-2026-78118-e336847b","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/userspace/userspace.c","function":"clear_perms_cb"},"deprecated":false,"digest":{"function_hash":"255785859431812144881753324546568721386","length":116}},{"deprecated":false,"digest":{"line_hashes":["78913640463744456375030849479316540791","51435297851660925979658052826010762094","74518386416815107314693480427156878193","93073592743604180887133101003193956383","263788381212226275300980516055182715147","307705270330818586450346774983573186908","308664891010761505560662775863384845768","90066309762643605350686022761750869174","262424936245433801033261279560217152401","22027641512970554716745756532083466978","35836478828768758344473817159447050201","138139958723224572404362816890612811089","151177028220720960005062516810835491612","33143078737705216390343695432386292907","334967431625260399700072349441935846937","84236782902038769480343654263621706343","230053631731298668351590340108486182033","197589904592764861127532299317991898048","312949219819588561193367458561575305397","226317736950781788949607182615084939282","3257128596127183035492754451588885037","93498344360799647857115608622969390174","163393411597384460725969122176824565163","235199902028697539503947402530756700801","69007825090281232367081904934718998159","99528777015213181176227422589015090989","106838019985462286151879543230850304701","147748308404601127420546051379435009810","123661722136670928991276036822540298423","334634481944251176755495639764986334318"],"threshold":0.9},"id":"CVE-2026-78118-e6413041","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33","target":{"file":"kernel/timer.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}