Is CVE-2026-78118 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78118 being exploited in the wild.

How severe is CVE-2026-78118?

High severity, with a CVSS score of 7, published 21 October 2026.

How is CVE-2026-78118 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-78118?

Check whether you run Zephyr Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78118: Zephyr kernel race condition in timer expiration handler

CVE-2026-78118 · Severity: high · CVSS 7 · Published 2026-10-21

Zephyr's real-time kernel contains a race condition in its timer subsystem that can be triggered by an unprivileged user on multi-CPU systems. An attacker can exploit this to cause kernel crashes or potentially corrupt scheduler state. On systems with user-mode execution enabled, this flaw allows local denial of service with minimal privileges.

Vendors: Zephyr.

Quick answers

Is CVE-2026-78118 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78118 being exploited in the wild.
How severe is CVE-2026-78118?: High severity, with a CVSS score of 7, published 21 October 2026.
Which products and versions are affected?: Zephyr Kernel unknown.
Is there a fix for CVE-2026-78118?: Yes: fixed in unknown. Until then: Disable CONFIG_USERSPACE or CONFIG_MP_MAX_NUM_CPUS if unprivileged user access to kernel APIs is not required; restrict multi-threaded timer use in untrusted contexts until patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78118 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-78118?: Check whether you run Zephyr Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: unknown

Disable CONFIG_USERSPACE or CONFIG_MP_MAX_NUM_CPUS if unprivileged user access to kernel APIs is not required; restrict multi-threaded timer use in untrusted contexts until patched.

Technical details

A race condition exists between z_timer_expiration_handler() and halt_thread() where the timer handler reads a wait queue head while holding only the timer lock, but the scheduler lock (needed for safe queue mutation) is not held. On SMP systems, if the last waiter is removed from another CPU during this window, the handler can read a pointer to a freed thread, the list sentinel, or an arbitrary tree node, then perform unsafe writes through these pointers via unpend_thread_no_timeout() and arch_thread_return_value_set(). The vulnerability requires CONFIG_MP_MAX_NUM_CPUS > 1 and either local code execution or CONFIG_USERSPACE enabled for exploitation, with timing-dependent outcomes ranging from kernel crash to scheduler corruption.

Affected products

Zephyr kernel unknown

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.