# CVE-2026-12366: Zephyr use-after-free in dynamic k_timer cleanup

Source: https://junglewise.ai/threats/cve-2026-12366-zephyr-use-after-free-in-dynamic-k-timer-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-12366 · Severity: high · CVSS 8.8 · Published 2026-08-14

Zephyr RTOS contains a memory safety bug in its dynamic timer object cleanup that allows an unprivileged user-mode thread to trigger a use-after-free vulnerability in kernel code. When a dynamically-allocated timer is freed without properly cancelling its timeout, a stale reference remains in the kernel's timeout queue. When the timer fires, kernel code dereferences and writes to already-freed memory, enabling privilege escalation and arbitrary code execution within the kernel.

Technologies: [Zephyr Project Zephyr](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-12366 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12366 being exploited in the wild.

**How severe is CVE-2026-12366?** High severity, with a CVSS score of 8.8, published 14 August 2026.

**Which products and versions are affected?** Zephyr Project Zephyr <unknown.

**Is there a fix for CVE-2026-12366?** A patch was published: Fix adds k_timer_cleanup() to cancel timeouts before freeing K_OBJ_TIMER Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12366 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-12366?** Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in kernel/userspace/userspace.c's unref_check() function, which frees dynamically-allocated kernel objects when their reference count reaches zero. The cleanup switch statement handled K_OBJ_MSGQ and K_OBJ_STACK but was missing a case for K_OBJ_TIMER. This means k_timer objects are freed without cancelling their embedded _timeout node, which remains linked in the global _timeout_q queue. When the armed timer later expires, z_timer_expiration_handler() walks the queue and dereferences the freed node, writing to freed kernel heap memory in interrupt context. The vulnerability is reachable from unprivileged user code under CONFIG_USERSPACE + CONFIG_DYNAMIC_OBJECTS via the k_object_release() syscall (or thread exit via k_thread_perms_all_clear()); an attacker can arm the timer and release it to trigger the use-after-free. The fix adds k_timer_cleanup() to cancel pending timeouts before freeing timer objects.

## Affected products

- Zephyr Project Zephyr <unknown

## Timeline

- 2026-08-14: disclosed
- patched: Fix adds k_timer_cleanup() to cancel timeouts before freeing K_OBJ_TIMER

## Related threats

- [Zephyr UART wide-data syscall verifier NULL pointer dereference](https://junglewise.ai/threats/cve-2026-90834-the-user-mode-syscall-verifiers-for-the-16-bit-wide-data-uart-api)
- [Zephyr PTP port unvalidated logMessageInterval denial of service](https://junglewise.ai/threats/cve-2026-87042-the-ieee-1588-ptp-port-implementation-in-subsys-net-lib-ptp-port)
- [Zephyr HTTP server HTTP/2 buffer overflow via static file serving](https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection)
- [Zephyr OpenThread hardcoded default joiner credential](https://junglewise.ai/threats/cve-2026-19741-zephyr-s-openthread-integration-defined-config-openthread-joiner)
- [Zephyr ARM64 MMU ASID allocation collision in memory domain isolation](https://junglewise.ai/threats/cve-2026-19574-the-arm64-mmu-back-end-allocated-address-space-identifiers-asids)