Zephyr RTOS CVE-2026-12366

Exploitation requires the target firmware to be compiled with both CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y; without both options the vulnerable disposal path is unreachable from user threads. The attacking thread must be a valid Zephyr user thread (not a supervisor thread) and must hold at least one permission on a dynamically-allocated, initialized, and armed k_timer - confirmed by the K_OBJ_FLAG_INITIALIZED guard added in the fix. The trigger sequence is: arm the timer with k_timer_start() so the _timeout dnode is linked in _timeout_q, then drop the last permission via k_object_release() syscall or by thread exit (which invokes k_thread_perms_all_clear()). Exploitation is bounded by the local attack vector - an attacker must already have code execution as a Zephyr user thread on the target device; remote-only attackers cannot trigger this without a separate initial-access primitive. The bug does not affect supervisor threads, which bypass the userspace permission model entirely.

The CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is well-calibrated for this vulnerability: the local attack vector correctly bounds exposure to systems where untrusted code executes as Zephyr user threads, but the scope change and full CIA impact reflect that successful exploitation yields unrestricted kernel-context memory writes. Attack complexity is genuinely low because the UAF trigger is a deterministic call sequence with no heap spray, no race window, and no ASLR dependency required at the trigger stage. No EPSS score was available in the provided data, no CISA KEV listing exists at time of analysis, and no public proof-of-concept has been identified, so confirmed in-the-wild exploitation is not established. Despite the absence of known active exploitation, the non-probabilistic nature of the primitive means that even a mid-sized municipal IT team in swidnica responsible for Zephyr-based IoT infrastructure should treat this as urgent patching rather than deferring to broader threat intelligence. Real-world risk is highest in constrained embedded and safety-critical environments that specifically enable CONFIG_USERSPACE to sandbox untrusted firmware modules - the very deployment model that makes the vulnerable code path reachable.

An unprivileged Zephyr user thread allocates a dynamic timer object, starts it with k_timer_start() to arm the embedded dnode in _timeout_q, then calls k_object_release() to drop the last permission on the object - triggering unref_check() to free the timer's storage while the dnode remains queued. When the timer period elapses and z_timer_expiration_handler() fires on the now-freed node, an attacker who has influenced the heap layout to reallocate that storage with attacker-controlled content can achieve arbitrary writes at kernel privilege, completing a full sandbox escape. No public proof-of-concept has been identified at time of analysis, but the trigger sequence is deterministic and requires no race condition or advanced heap manipulation to reach the UAF itself.