Loading story…
A high-severity flaw tracked as CVE-2026-12366 was disclosed in the Zephyr RTOS, where userspace object disposal could free an armed, dynamically allocated k_timer without first cancelling its queued timeout. The bug leaves a dangling entry in the global timeout queue, and when the timer later expires, Zephyr may dereference freed kernel heap memory in kernel or ISR context, creating a deterministic use-after-free and memory-corruption condition.
The issue is reachable by an unprivileged user thread when CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS are enabled, making it a potential sandbox-escape and local privilege-escalation primitive. Zephyr addressed the problem in a kernel change that adds k_timer_cleanup(), which cancels the timer, waits for any in-flight expiration handler to finish, and can return -EAGAIN if threads are still pending on the timer wait queue; the fix also updates userspace cleanup logic and tracing hooks to use the safer timer cleanup path.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-12366 was published as a high-severity Zephyr use-after-free vulnerability affecting versions 1.12.0 through before 4.5.0. The issue allows an unprivileged user thread to trigger deterministic kernel-memory corruption via disposal of an armed dynamically allocated k_timer, creating a local privilege-escalation primitive.
A Zephyr kernel patch introduced the new k_timer_cleanup() API and updated userspace object cleanup to call it for K_OBJ_TIMER objects before freeing their storage. The change prevents freeing an armed dynamically allocated timer while its timeout or expiration handler could still reference the memory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical use-after-free vulnerability, tracked as CVE-2025-38352, has been identified in the Linux kernel's POSIX CPU timer implementation. The flaw arises from a race condition in the `handle_posix_cpu_timers()` function, which can be exploited when a process enters a zombie state and timer structures are prematurely freed while still in use. This vulnerability is particularly impactful on systems with `CONFIG_POSIX_CPU_TIMERS_TASK_WORK` disabled, notably affecting 32-bit Android kernels and Linux LTS 6.12.33. A proof-of-concept (PoC) exploit for CVE-2025-38352 has been publicly released, demonstrating how attackers can leverage the race condition to trigger kernel memory corruption and potentially escalate privileges locally. The exploit involves creating a POSIX CPU timer, forcing a thread into a zombie state, and deleting the timer at a critical moment to induce a use-after-free scenario. Successful exploitation is evidenced by KASAN memory sanitizer warnings, and the vulnerability poses a significant risk for local privilege escalation on affected Linux systems.
Jun 29, 2026
A high-severity vulnerability tracked as **`CVE-2026-10849`** was disclosed in the Zephyr RTOS **hawkBit OTA client**, where an off-by-one error in `response_json_cb()` can write a terminating NUL byte past the end of a heap buffer while processing an HTTP response body. The flaw affects Zephyr versions **`2.4.0` through `4.4.x`** and is remotely reachable because a hawkBit server can control response length and fragmentation, including in scenarios involving a malicious, compromised, or man-in-the-middle update server. The issue carries a **CVSS 3.1 score of 8.2** and is expected to primarily cause heap corruption and denial of service, with some potential for broader corruption depending on the allocator. The Zephyr Project addressed the bug in commit **`59d7ab58d853489e6134081cadb11733730264ac`**, which corrects the buffer sizing logic to allocate **body length plus one byte** for the trailing terminator. The patch also replaces `strncpy` with `memcpy` when copying the response fragment so the terminator remains within bounds, eliminating the out-of-bounds write condition in the hawkBit management subsystem.
Aug 4, 2026
**CVE-2025-38352** is an actively exploited Linux kernel race condition in POSIX CPU timer processing. A timing flaw between `handle_posix_cpu_timers()` and `posix_cpu_timer_del()` while a task exits can cause a use-after-free, allowing a local low-privileged attacker to crash the host or escalate privileges. Red Hat rates the issue Important with a CVSS v3.1 score of 7.8; no qualifying mitigation is available. Red Hat released fixes across affected kernel packages, including `kernel-rt-4.18.0-553.74.1.rt7.415.el8_10` for Red Hat Enterprise Linux 8 Real Time, Real Time for NFV, and x86_64 Extended Life Cycle 8.10 deployments. Organizations should install the applicable updated kernel packages and reboot affected systems promptly, prioritizing hosts where untrusted or low-privileged local access is possible.
Aug 26, 2026