{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zephyr-rtos-with-config_mctp-and-config_mctp_i2c_gpio_target-enabled/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-78118"},{"id":"CVE-2026-79976"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zephyr RTOS (\u003c current patched versions)","Zephyr RTOS (with CONFIG_MCTP and CONFIG_MCTP_I2C_GPIO_TARGET enabled)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","embedded","mctp","i2c"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA race condition exists in the Zephyr RTOS kernel due to improper locking of the thread wait queue in Symmetric Multiprocessing (SMP) environments. The z_waitq_head() helper function is called without holding the required _sched_spinlock, allowing for out-of-bounds access or use-after-free conditions when a timer expiration handler interacts with a thread wait queue simultaneously with a thread abortion. Exploitation via system calls from unprivileged user-mode threads can lead to supervisor-mode memory corruption, scheduler state instability, or kernel crashes. This vulnerability only affects multi-CPU builds (CONFIG_MP_MAX_NUM_CPUS \u0026gt; 1).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unprivileged user-mode thread triggers an attempt to exploit the race condition via system calls.\u003c/li\u003e\n\u003cli\u003eThe attacker uses k_thread_create() and k_thread_abort() to manipulate thread states in the wait queue.\u003c/li\u003e\n\u003cli\u003eSimultaneously, k_timer_start() and k_timer_status_sync() are utilized to trigger the z_timer_expiration_handler().\u003c/li\u003e\n\u003cli\u003eThe handler calls z_waitq_head() without holding the _sched_spinlock.\u003c/li\u003e\n\u003cli\u003eA race window is opened where a competing thread is removed from the queue on a different CPU.\u003c/li\u003e\n\u003cli\u003ez_waitq_head() returns an invalid pointer (either a list sentinel or a pointer to a freed thread structure).\u003c/li\u003e\n\u003cli\u003eThe kernel performs an out-of-bounds or use-after-free write via unpend_thread_no_timeout() and arch_thread_return_value_set().\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary observed outcome is a kernel crash (DoS). In controlled scenarios, exploitation leads to supervisor-mode memory corruption or scheduler state instability, which could potentially be leveraged for privilege escalation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Zephyr RTOS projects to include the fix that enforces the use of z_waitq_head_locked() and encapsulates timer expiration logic within a single LOCK_SCHED_SPINLOCK region.\u003c/li\u003e\n\u003cli\u003eReview kernel configurations to ensure that multi-CPU environments are managed with appropriate locking primitives as defined in the vendor security patch.\u003c/li\u003e\n\u003cli\u003eAudit custom system call implementations for race conditions involving wait queue access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T19:59:24Z","date_published":"2026-10-21T19:59:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zephyr-rtos-race-condition/","summary":"A race condition in the Zephyr RTOS scheduler wait queue management allows unprivileged user-mode threads to trigger out-of-bounds memory access or use-after-free in supervisor context by exploiting improper locking in SMP configurations.","title":"Zephyr RTOS: Kernel wait queue race condition (CVE-2026-78118)","url":"https://feed.craftedsignal.io/briefs/2026-10-zephyr-rtos-race-condition/"}],"language":"en","title":"CraftedSignal Threat Feed - Zephyr RTOS (With CONFIG_MCTP and CONFIG_MCTP_I2C_GPIO_TARGET Enabled)","version":"https://jsonfeed.org/version/1.1"}