CVE-2026-12365
- Source
- https://cve.org/CVERecord?id=CVE-2026-12365
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12365.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-12365
- Aliases
-
- GHSA-rhmh-r93p-6g99
- Published
- 2026-08-14T17:52:05.922Z
- Modified
- 2026-08-17T04:19:21.591567Z
- Severity
-
- 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
- Summary
- Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race
- Details
-
A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout() is in flight (blocked acquiring the work-queue spinlock), a concurrent cancellation does not wait for that handler to finish. In unschedulelocked() the pre-fix code called zaborttimeout(), which for an already-announcing record returns -EINVAL without removing it; cancelasynclocked() then observes the work as idle, so even kworkcanceldelayablesync() and kworkflush_delayable() return without blocking on the in-flight handler.
Because those are the APIs the kernel header documents as the safe way to cancel before freeing a kworkdelayable, a caller that frees the object immediately after a successful sync cancel can race the still-pending handler. worktimeout() subsequently dereferences the freed record: it reads to->dticks via zistimeouthandlercanceled() and, if the freed slot has been reused so the bail check fails, performs a read-modify-write of wp->flags (KWORKDELAYEDBIT) and submits work against a stale dw->queue pointer — a use-after-free read and write.
The k_work API is kernel-mode only (no __syscall entry point), so this is a kernel-internal concurrency defect rather than a userspace privilege escalation. Triggering it requires an SMP build and a subsystem that schedules and then frees (or reschedules) a delayable work item in the narrow window while its timeout is announcing; an attacker able to influence the timing of such teardown (for example via connection churn driving subsystem timers) has a plausible but probabilistic path. The impact is kernel memory corruption or crash (denial of service).
The fix makes unschedulelocked() wait, by spinning on ztryaborttimeout() returning -EAGAIN while releasing and re-acquiring the work spinlock, until any in-flight handler completes before returning, and switches worktimeout() to atomic KWORKDELAYEDBIT ownership. This closes both the free-then-handler use-after-free and the related reschedule early-fire race.
- Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "introduced": "2.6.0" }, { "fixed": "4.5.0" } ], "source": "AFFECTED_FIELD" } ], "cna_assigner": "zephyr", "cwe_ids": [ "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12365.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12365.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rhmh-r93p-6g99
- https://nvd.nist.gov/vuln/detail/CVE-2026-12365
- https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected versions
v1.*
v1.0.0
v1.1.0
v1.1.0-rc1
v1.10.0
v1.10.0-rc1
v1.10.0-rc2
v1.10.0-rc3
v1.11.0
v1.11.0-rc1
v1.11.0-rc2
v1.11.0-rc3
v1.12.0
v1.12.0-rc1
v1.12.0-rc2
v1.12.0-rc3
v1.13.0
v1.13.0-rc1
v1.13.0-rc2
v1.13.0-rc3
v1.14.0
v1.14.0-rc1
v1.14.0-rc2
v1.14.0-rc3
v1.2.0
v1.2.0-rc1
v1.2.0-rc2
v1.3.0
v1.3.0-rc1
v1.3.0-rc2
v1.4.0
v1.4.0-rc1
v1.4.0-rc2
v1.4.0-rc3
v1.5.0
v1.5.0-rc0
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.5.0-rc4
v1.6.99
v1.7.99
v1.8.99
v1.9.0
v1.9.0-rc1
v1.9.0-rc2
v1.9.0-rc3
v1.9.0-rc4
v2.*
v2.0.0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.1.0
v2.1.0-rc1
v2.1.0-rc2
v2.1.0-rc3
v2.2.0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.3.0
v2.3.0-rc1
v2.3.0-rc2
v2.4.0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.5.0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.5.0-rc4
v2.6.0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.7.99
v3.*
v3.0.0
v3.0.0-rc1
v3.0.0-rc2
v3.0.0-rc3
v3.1.0
v3.1.0-rc1
v3.1.0-rc2
v3.1.0-rc3
v3.2.0
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.3.0-rc3
v3.4.0
v3.4.0-rc1
v3.4.0-rc2
v3.4.0-rc3
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.5.0-rc3
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3
zephyr-v1.*
zephyr-v1.0.0
zephyr-v1.1.0
zephyr-v1.10.0
zephyr-v1.11.0
zephyr-v1.12.0
zephyr-v1.13.0
zephyr-v1.14.0
zephyr-v1.2.0
zephyr-v1.3.0
zephyr-v1.4.0
zephyr-v1.5.0
zephyr-v1.9.0
zephyr-v2.*
zephyr-v2.0.0
zephyr-v2.1.0
zephyr-v2.2.0
zephyr-v2.3.0
zephyr-v2.4.0
zephyr-v2.5.0
zephyr-v2.6.0
zephyr-v3.*
zephyr-v3.0.0
zephyr-v3.1.0
zephyr-v3.2.0
zephyr-v3.3.0
zephyr-v3.4.0
zephyr-v3.5.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12365.json"
vanir_signatures
[
{
"target": {
"function": "work_timeout_stop_locked",
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-16d6a618",
"signature_version": "v1",
"digest": {
"length": 156.0,
"function_hash": "239513898230447693595527634661069693347"
},
"signature_type": "Function"
},
{
"target": {
"function": "k_work_cancel_delayable",
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-64f04d42",
"signature_version": "v1",
"digest": {
"length": 277.0,
"function_hash": "172121697861166700260592906013976680749"
},
"signature_type": "Function"
},
{
"target": {
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-7a345fb5",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153252386360707382122943946168968935484",
"14945460685538635617202583622091037950",
"222450818200792738686926169987372603133",
"60310941802114192154400693254874558037",
"3311096056985230901305908416586872828",
"134265437625658522055519990937916721050",
"235799040848523767820221550909131193331",
"113782974449414870853076195543596158385",
"327362131811284887319074582453417665738",
"250679015642867065828296475475286705284",
"98482576484949277183347694801165533341",
"85587674057586761129289779368926988173",
"215527244398505535555567111796605830539",
"158496292113580141277511198244215048192",
"294240891016785804688398046880576833140",
"118842441736677874782677716639890985142",
"103325567323812144711643995688869377751",
"42006986859820528918393338524064021305",
"141095510433998880204190810469268345609",
"167043705863497753309791449002584135708",
"316825439507825814815486937800197892261",
"127530071429309885523423455827625133742",
"204620381197802286533416171113291986967",
"147369670199073416710185887020037594837",
"190212958576676880957664987562094834369",
"133824768821220846076791466302086070572",
"161248145768812645150615844927516957594",
"147366721543430479604789414554614440474",
"240055010205243426485230699961647267536",
"128659801050106802873904080163418427323",
"70267715171331729549223918194643505104",
"258930787314423154143386549478580263412",
"59924159137676869987363159757717912044",
"85522175002250808261875769273193209709",
"188699310775192540206410397219466396308",
"129564479977005374929254370263738586719",
"270161943590929953158725217226605412813",
"292221025264386900923105211803097591701",
"61242962605232588691349497255666757217",
"13344968681156544665356486728807324456",
"107575772146488941597624444080080499544",
"105954788662828894202640895141100925714",
"318499512772148308829879793803665950687",
"133300684305341710046322746939371632689",
"49280687460033302660152003668981855924",
"272230741457859913814868391715381306807"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "work_timeout_handler",
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-834722eb",
"signature_version": "v1",
"digest": {
"length": 661.0,
"function_hash": "258201184071671259821934925216118482072"
},
"signature_type": "Function"
},
{
"target": {
"function": "k_work_cancel_delayable_sync",
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-8cd92878",
"signature_version": "v1",
"digest": {
"length": 687.0,
"function_hash": "191972899073794895545644972039635149263"
},
"signature_type": "Function"
},
{
"target": {
"function": "work_timeout",
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-a4267f55",
"signature_version": "v1",
"digest": {
"length": 429.0,
"function_hash": "10469933923685389090977516538083765261"
},
"signature_type": "Function"
},
{
"target": {
"function": "unschedule_locked",
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-c8877506",
"signature_version": "v1",
"digest": {
"length": 219.0,
"function_hash": "116220373502602691633287967549970527949"
},
"signature_type": "Function"
},
{
"target": {
"function": "k_work_reschedule_for_queue",
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-d20a28e8",
"signature_version": "v1",
"digest": {
"length": 431.0,
"function_hash": "224766034729847320031736624228039935968"
},
"signature_type": "Function"
},
{
"target": {
"function": "cancel_delayable_async_locked",
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-e2112992",
"signature_version": "v1",
"digest": {
"length": 112.0,
"function_hash": "145963565011887590591373571851832691182"
},
"signature_type": "Function"
},
{
"target": {
"function": "k_work_flush_delayable",
"file": "kernel/work.c"
},
"deprecated": false,
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/59cf34bf212eeb5c7ea88b97e15842b1e7c1a6b7",
"id": "CVE-2026-12365-f3000354",
"signature_version": "v1",
"digest": {
"length": 828.0,
"function_hash": "231058846873810732103531597566061026716"
},
"signature_type": "Function"
}
]
vanir_signatures_modified
"2026-08-17T04:19:21Z"