Zephyr RTOS EUVD-2026-58752

Zephyr RTOS implements a privilege-separated userspace model (CONFIG_USERSPACE) combined with a dynamic kernel-object allocator (CONFIG_DYNAMIC_OBJECTS) that tracks per-object reference counts in unref_check() within kernel/userspace/userspace.c. When a reference count drops to zero, unref_check() executes a per-type cleanup switch before calling k_free(dyn->data). The original switch covered K_OBJ_MSGQ and K_OBJ_STACK but contained no K_OBJ_TIMER case. A k_timer embeds a struct _timeout dnode that is physically linked into the global timeout queue _timeout_q via a doubly-linked list whenever the timer is armed with k_timer_start(). The missing cleanup case meant that freeing a running timer skipped timeout cancellation entirely, leaving a dangling pointer in _timeout_q to now-freed kernel heap. The root cause is CWE-416 (Use After Free): when the timeout period elapses, the kernel's timeout machinery walks _timeout_q and invokes z_timer_expiration_handler() on the freed node, reading and writing arbitrary freed storage at kernel/ISR privilege. Critically, this is deterministic - no SMP race or timing window is required, only the sequence of arm-then-release. The fix in commit 1e68351a2572f9ae480be71da4aca9aa90db3fb2 introduces k_timer_cleanup(), which cancels the timeout via z_try_abort_timeout() under a spinlock and spins until any in-flight expiration handler on another CPU completes before returning. A new K_OBJ_TIMER case in unref_check() calls k_timer_cleanup() (guarded by K_OBJ_FLAG_INITIALIZED to avoid reading garbage from an uninitialized dnode) prior to freeing storage.