Zephyr RTOS: Kernel wait queue race condition (CVE-2026-78118)

A race condition exists in the Zephyr RTOS kernel due to improper locking of the thread wait queue in Symmetric Multiprocessing (SMP) environments. The z_waitq_head() helper function is called without holding the required _sched_spinlock, allowing for out-of-bounds access or use-after-free conditions when a timer expiration handler interacts with a thread wait queue simultaneously with a thread abortion. Exploitation via system calls from unprivileged user-mode threads can lead to supervisor-mode memory corruption, scheduler state instability, or kernel crashes. This vulnerability only affects multi-CPU builds (CONFIG_MP_MAX_NUM_CPUS > 1).

Attack Chain

1. An unprivileged user-mode thread triggers an attempt to exploit the race condition via system calls.
2. The attacker uses k_thread_create() and k_thread_abort() to manipulate thread states in the wait queue.
3. Simultaneously, k_timer_start() and k_timer_status_sync() are utilized to trigger the z_timer_expiration_handler().
4. The handler calls z_waitq_head() without holding the _sched_spinlock.
5. A race window is opened where a competing thread is removed from the queue on a different CPU.
6. z_waitq_head() returns an invalid pointer (either a list sentinel or a pointer to a freed thread structure).
7. The kernel performs an out-of-bounds or use-after-free write via unpend_thread_no_timeout() and arch_thread_return_value_set().

Impact

The primary observed outcome is a kernel crash (DoS). In controlled scenarios, exploitation leads to supervisor-mode memory corruption or scheduler state instability, which could potentially be leveraged for privilege escalation.

Recommendation

• Update Zephyr RTOS projects to include the fix that enforces the use of z_waitq_head_locked() and encapsulates timer expiration logic within a single LOCK_SCHED_SPINLOCK region.
• Review kernel configurations to ensure that multi-CPU environments are managed with appropriate locking primitives as defined in the vendor security patch.
• Audit custom system call implementations for race conditions involving wait queue access.