CVE-2026-78118
- Source
- https://cve.org/CVERecord?id=CVE-2026-78118
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78118.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-78118
- Aliases
-
- GHSA-gm6w-pv43-m3vf
- Published
- 2026-10-21T18:19:32Z
- Modified
- 2026-10-22T07:21:15Z
- Severity
-
- 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP
- Details
-
The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock _sched_spinlock that serializes wait-queue mutation. The consequential call site is z_timer_expiration_handler() in kernel/timer.c, which held only the timer subsystem lock timer_lock while reading timer->wait_q and then unpending, setting the return value of, and readying the thread it obtained. halt_thread() in kernel/sched.c removes an aborted thread from its wait queue while holding only _sched_spinlock, so the two paths are not mutually exclusive.
When the last waiter is removed on another CPU inside that window, sys_dlist_peek_head() can return the list sentinel — a pointer into the k_timer object itself — typed as a struct k_thread * (with CONFIG_WAITQ_SCALABLE, rb_get_min() can return an arbitrary node of a tree being restructured), or it can return a pointer to a thread that has already been unpended and, for dynamically allocated threads, freed. The handler then calls unpend_thread_no_timeout(), which performs a sys_dlist_remove() through pointers read from that object, and arch_thread_return_value_set(), which writes unconditionally through the pointer.
The result is out-of-bounds and use-after-free writes in supervisor context, plus scheduler state corruption; a milder outcome is a thread that has re-pended elsewhere being woken with a success return value from an unrelated blocking call. All of the primitives needed to drive the interleaving — k_timer_start(), k_timer_status_sync(), k_thread_create() and k_thread_abort() — are system calls, so with CONFIG_USERSPACE enabled an unprivileged user-mode thread can attempt the race against kernel-owned data.
Exploitation requires a multi-CPU build (CONFIG_MP_MAX_NUM_CPUS greater than one; the affected region is a no-op on uniprocessor targets), local code execution, and winning a narrow timing window, so the practical outcome is most often a kernel crash rather than controlled corruption. The fix splits the helper into z_waitq_head_locked() for callers that already hold the scheduler spinlock and a z_waitq_head() that acquires it, and brings the timer expiration handler's head read, unpend and ready under a single LOCK_SCHED_SPINLOCK region.
- Database specific
{ "cna_assigner": "zephyr", "cwe_ids": [ "CWE-362" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78118.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "2.2.0" }, { "fixed": "4.5.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78118.json
- https://github.com/zephyrproject-rtos/zephyr
- https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gm6w-pv43-m3vf
- https://nvd.nist.gov/vuln/detail/CVE-2026-78118
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected ranges
- Type
- GIT
- Repo
- https://github.com/zephyrproject-rtos/zephyr
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "fixed": "a9b21fb354e8468dd15db307c3e599dc68b7ef33" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
v1.*
v1.0.0
v1.1.0
v1.1.0-rc1
v1.10.0
v1.10.0-rc1
v1.10.0-rc2
v1.10.0-rc3
v1.11.0
v1.11.0-rc1
v1.11.0-rc2
v1.11.0-rc3
v1.12.0
v1.12.0-rc1
v1.12.0-rc2
v1.12.0-rc3
v1.13.0
v1.13.0-rc1
v1.13.0-rc2
v1.13.0-rc3
v1.14.0
v1.14.0-rc1
v1.14.0-rc2
v1.14.0-rc3
v1.2.0
v1.2.0-rc1
v1.2.0-rc2
v1.3.0
v1.3.0-rc1
v1.3.0-rc2
v1.4.0
v1.4.0-rc1
v1.4.0-rc2
v1.4.0-rc3
v1.5.0
v1.5.0-rc0
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.5.0-rc4
v1.6.99
v1.7.99
v1.8.99
v1.9.0
v1.9.0-rc1
v1.9.0-rc2
v1.9.0-rc3
v1.9.0-rc4
v2.*
v2.0.0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.1.0
v2.1.0-rc1
v2.1.0-rc2
v2.1.0-rc3
v2.2.0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.3.0
v2.3.0-rc1
v2.3.0-rc2
v2.4.0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.5.0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.5.0-rc4
v2.6.0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.7.99
v3.*
v3.0.0
v3.0.0-rc1
v3.0.0-rc2
v3.0.0-rc3
v3.1.0
v3.1.0-rc1
v3.1.0-rc2
v3.1.0-rc3
v3.2.0
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.3.0-rc3
v3.4.0
v3.4.0-rc1
v3.4.0-rc2
v3.4.0-rc3
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.5.0-rc3
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3
zephyr-v1.*
zephyr-v1.0.0
zephyr-v1.1.0
zephyr-v1.10.0
zephyr-v1.11.0
zephyr-v1.12.0
zephyr-v1.13.0
zephyr-v1.14.0
zephyr-v1.2.0
zephyr-v1.3.0
zephyr-v1.4.0
zephyr-v1.5.0
zephyr-v1.9.0
zephyr-v2.*
zephyr-v2.0.0
zephyr-v2.1.0
zephyr-v2.2.0
zephyr-v2.3.0
zephyr-v2.4.0
zephyr-v2.5.0
zephyr-v2.6.0
zephyr-v3.*
zephyr-v3.0.0
zephyr-v3.1.0
zephyr-v3.2.0
zephyr-v3.3.0
zephyr-v3.4.0
zephyr-v3.5.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78118.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "253233798720056269051366703268357488952",
"length": 996
},
"id": "CVE-2026-78118-009b37ff",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/userspace/userspace.c",
"function": "unref_check"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"230956542754992470005590213882443644968",
"313094644964595346876504586741043855696",
"306401905976573215431098741695924204020",
"288132748974578799349738332916232953686",
"206878136099227429227530392311072955152",
"302309212883246005150476475566092955236",
"253428894179137444025661420498172680263",
"47772974190076095174672150095242215123",
"159377944429679060589075023981362166264",
"66145034221438484827598553684430146005",
"190585968547092395146396895059281117454",
"40800659499644807269369510603127974177",
"207927782905877832031434342881710257315",
"9770312928309931749137253378375994050",
"209003662660347400533140060371739452573",
"307754327507593290279488423731904701550",
"158937699821319517309971989720470568306",
"1928962195325020258458036102611359099",
"231559616425347338373107223811118260570",
"283157027877877431260235099309594251921",
"249767370381025212975408046730283110795"
],
"threshold": 0.9
},
"id": "CVE-2026-78118-25fb9175",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/stack.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "195576453635795299972175367447659090341",
"length": 358
},
"id": "CVE-2026-78118-269ad171",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/userspace/userspace.c",
"function": "k_thread_perms_clear"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"291298499856443943080380415216710731329",
"37483347422301404901575007076023046275",
"326633752813922983537566219245844846004",
"61143559679606377711289611581465058063",
"209244077265229697880913199791665280013",
"279619295308435291151376752369862867709",
"88101223765963818816286070050968206002",
"261342441636594500200804858091805851828",
"275837753848589670066958013791842915292",
"15600262011477306482481590395959657462"
],
"threshold": 0.9
},
"id": "CVE-2026-78118-295f8ebc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/sched.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"134116075192707497407413576526439893974",
"198316712993623884316711052771508383289",
"115824512592898030891891941067908243354",
"158631799057137655070878640199311663792"
],
"threshold": 0.9
},
"id": "CVE-2026-78118-2d168d52",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/mutex.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"130787472691517129637480926179370912216",
"14964335042154446983051560163741592424",
"83762162753121534720841511933675613800",
"194609561137875983599186827931964686119",
"153303669653869836344712728454426343292",
"139141565623184975410949349764660551742",
"14359719305555516581898562468708371273",
"336876064203517262123290420992140422594",
"212582457600779964399473646430566587224",
"45690399741147502372263027234848193564",
"193843241415186423917210253599625253045",
"129875880980866891167837682228390018685"
],
"threshold": 0.9
},
"id": "CVE-2026-78118-46d3e05f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/msg_q.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"10715709629819763455139022513134418048",
"88551363286323266911067479112099797899",
"55657780939027453832543812386601699434",
"207868509829313814181988931860309244253",
"292934044678755762921313223892648018622",
"169510801571093686550790908841734434060",
"13594094396507611719873877624173368953",
"271343662911534031118015876687330932239",
"89965373827429781300834761315040966609",
"89269969695946863028159434069615452924",
"127306674045452790572486025028777704048",
"326631817517170363707970347514953591208",
"83500021262888392174271882294344111324",
"264669539577777519066171056136582193928",
"163153566256818349458494949316310746936",
"111722999866404272679060984639802158604",
"265414019505591844268716308620107891810",
"175848409453815881175249465133628789321",
"276788198250679715381668006821519225327",
"225846099998833891396455218462291389628",
"80697508569864096779307479506718883799",
"162317893457539573190099942108053020078",
"29706006113122494887700720831389050438",
"82898189036657310313535186111982396299",
"119672771320277413406213301969762472980",
"303653328546284501823617772390616052136",
"13002678900735768907469591000750130713",
"272838968988210227310710669393887498479",
"128949828658695483380472552427915883017",
"230490725144862614152753009617969747488",
"14272361925567528489007241990438417835",
"302682896320600652607401913330564830151",
"159704671041696664579320411244693802175",
"3974652378957403453413726013051489755",
"29442543299505280471361700423907386925",
"200925757616808718109502268005649847744",
"131553572187702152915603429798411808631",
"15916980645212785627855684858215648083",
"308209115864547695692098157074858907713",
"5574809832923007205862619594409866537",
"233410294646912923544298665301508733814",
"46306841700287388266889421813574787812",
"89993857878714000961925497784676172576",
"244940037932406799744967611901811595292"
],
"threshold": 0.9
},
"id": "CVE-2026-78118-4d2e1ab4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/userspace/userspace.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "273299946393115485919719637805428629475",
"length": 537
},
"id": "CVE-2026-78118-697a7691",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/stack.c",
"function": "k_stack_cleanup"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "168379311740502004769327088311042505655",
"length": 149
},
"id": "CVE-2026-78118-849e52ff",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/userspace/userspace.c",
"function": "k_thread_perms_all_clear"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "71306542560218411460479701475022440420",
"length": 455
},
"id": "CVE-2026-78118-9d1cc452",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/msg_q.c",
"function": "k_msgq_cleanup"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"327702089576140952745386466647261766291",
"62445717254296447225892392877810759384",
"212378427520180428016283556488144685501",
"24174071459769719917039554255252472184",
"107218728722272118925357629759032180917",
"123183609285777206241248442905113281604",
"98779540039428168147526718314500697796",
"215585365620937788961670706583768938010",
"46387747233683354495333177387209857686",
"308574413610636647155140343112257434816",
"140753536118464114198421213601334507427",
"231286548640357298508563067692911410735",
"278771669535266474062339383156805052243",
"247123604177423670311074722833052337624",
"38144265829549042543240073610638464611",
"249195849472531244401400249168833907691"
],
"threshold": 0.9
},
"id": "CVE-2026-78118-9d3b5a69",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/include/wait_q.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "293901950504434416314691383523705652719",
"length": 1136
},
"id": "CVE-2026-78118-b704a522",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/timer.c",
"function": "z_timer_expiration_handler"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "256548138319842346789438837612542993182",
"length": 521
},
"id": "CVE-2026-78118-dea16070",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/timer.c",
"function": "k_timer_cleanup"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "255785859431812144881753324546568721386",
"length": 116
},
"id": "CVE-2026-78118-e336847b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/userspace/userspace.c",
"function": "clear_perms_cb"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"78913640463744456375030849479316540791",
"51435297851660925979658052826010762094",
"74518386416815107314693480427156878193",
"93073592743604180887133101003193956383",
"263788381212226275300980516055182715147",
"307705270330818586450346774983573186908",
"308664891010761505560662775863384845768",
"90066309762643605350686022761750869174",
"262424936245433801033261279560217152401",
"22027641512970554716745756532083466978",
"35836478828768758344473817159447050201",
"138139958723224572404362816890612811089",
"151177028220720960005062516810835491612",
"33143078737705216390343695432386292907",
"334967431625260399700072349441935846937",
"84236782902038769480343654263621706343",
"230053631731298668351590340108486182033",
"197589904592764861127532299317991898048",
"312949219819588561193367458561575305397",
"226317736950781788949607182615084939282",
"3257128596127183035492754451588885037",
"93498344360799647857115608622969390174",
"163393411597384460725969122176824565163",
"235199902028697539503947402530756700801",
"69007825090281232367081904934718998159",
"99528777015213181176227422589015090989",
"106838019985462286151879543230850304701",
"147748308404601127420546051379435009810",
"123661722136670928991276036822540298423",
"334634481944251176755495639764986334318"
],
"threshold": 0.9
},
"id": "CVE-2026-78118-e6413041",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/a9b21fb354e8468dd15db307c3e599dc68b7ef33",
"target": {
"file": "kernel/timer.c"
}
}
]
vanir_signatures_modified
"2026-10-22T07:21:15Z"