CVE-2026-11742: Zephyr Kernel Queue Use-After-Free Flaw

CVE-2026-11742 Overview

CVE-2026-11742 is a use-after-free vulnerability [CWE-416] in the Zephyr RTOS kernel queue helper z_queue_node_peek() located in kernel/queue.c. The functions z_impl_k_queue_peek_head() and z_impl_k_queue_peek_tail() read and dereference a queue node without holding the queue's spinlock. A concurrent k_queue_get() call on an SMP build, or under preemption/ISR concurrency, can free the node between peek obtaining the pointer and dereferencing it. Peek then reads flag bits and a data pointer from freed heap memory. The peek operations are also system calls reachable from CONFIG_USERSPACE threads, extending the attack surface to userspace.

Critical Impact
A local attacker winning a small race window can trigger a use-after-free read that leaks one pointer word of stale heap contents and may return a dangling pointer that crashes the system or corrupts memory when consumed as a live buffer.

Affected Products

Zephyr RTOS kernel queue subsystem (kernel/queue.c)
k_fifo and k_lifo wrappers over k_queue
net_buf, Bluetooth, USB, and networking subsystems that rely on buffer queues

Discovery Timeline

2026-08-07 - CVE-2026-11742 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-11742

Vulnerability Analysis

The Zephyr kernel queue helper z_queue_node_peek() dereferences a node taken from a queue's data_q list. It reads the node's flag byte and, for items enqueued via k_queue_alloc_append() or k_queue_alloc_prepend(), the data pointer of an internally allocated alloc_node struct. Every other accessor of this list, including k_queue_get(), operates under the queue's spinlock. k_queue_get() unlinks the node and calls k_free() on its backing alloc_node. Because peek was unsynchronized, its read-and-dereference operation was not atomic with respect to concurrent unlink-and-free.

Root Cause

The root cause is a missing lock. z_impl_k_queue_peek_head() and z_impl_k_queue_peek_tail() failed to acquire the queue spinlock before invoking z_queue_node_peek(). This violated the queue's locking discipline followed by all other accessors. The result is a classic use-after-free race window between pointer acquisition and dereference.

Attack Vector

Exploitation requires local access and the ability to race two operations on a shared queue. A userspace process invoking k_queue_peek_head() or k_queue_peek_tail() as system calls can race against another thread or CPU calling k_queue_get() on the same queue. On SMP builds, two CPUs suffice. Under preemption or ISR concurrency on a uniprocessor build, a preempting thread or interrupt handler can trigger the free between peek's pointer load and dereference. The returned dangling pointer, if consumed as a live buffer by the caller, can crash the system or corrupt memory.

 	void *data;
 };
 
+/* The queue must have its spinlock held before calling this function. */
 static void *z_queue_node_peek(sys_sfnode_t *node, bool needs_free)
 {
 	void *ret;

Source: Zephyr commit a6b6149a50cb — the patch adds a comment documenting the spinlock requirement and wraps both peek implementations with k_spin_lock()/k_spin_unlock().

Detection Methods for CVE-2026-11742

Indicators of Compromise

Unexplained kernel faults or memory corruption crashes on Zephyr devices running SMP or preemptible configurations that use k_queue_peek_head() or k_queue_peek_tail().
Bluetooth, USB, or networking subsystem instability where net_buf operations return stale or invalid buffer pointers.
Userspace threads on CONFIG_USERSPACE builds invoking peek system calls at high frequency against shared queues.

Detection Strategies

Audit Zephyr application code and downstream forks for callers of k_queue_peek_head(), k_queue_peek_tail(), k_fifo_peek_head(), k_fifo_peek_tail(), k_lifo_peek_head(), and k_lifo_peek_tail().
Enable kernel address sanitizer or hardware memory tagging where the target platform supports it to catch use-after-free reads on freed alloc_node structs.
Review commit history against upstream kernel/queue.c to confirm the spinlock fix from commit a6b6149a50cb is present.

Monitoring Recommendations

Log kernel panics and hard faults with full register and backtrace context, and correlate them with concurrent queue activity.
Instrument builds intended for security testing with CONFIG_ASSERT and heap integrity checks enabled to surface freed-memory access early.
Track heap allocation churn on queues used by USB, Bluetooth, and networking stacks under fuzzing or stress workloads.

How to Mitigate CVE-2026-11742

Immediate Actions Required

Apply the upstream fix from Zephyr commit a6b6149a50cb0f64061869f7536acbf80ccc5e0c, which wraps both peek implementations with the queue spinlock.
Rebuild and reflash all firmware images that link against affected Zephyr versions, prioritizing devices exposing CONFIG_USERSPACE or running SMP configurations.
Review the Zephyr security advisory GHSA-8xm3-4w69-29mm for affected version ranges and vendor guidance.

Patch Information

The fix is available in the upstream Zephyr project via commit a6b6149a50cb0f64061869f7536acbf80ccc5e0c. The patch adds k_spin_lock()/k_spin_unlock() around the read-and-dereference in z_impl_k_queue_peek_head() and z_impl_k_queue_peek_tail(), aligning peek with the locking discipline used by k_queue_get() and other accessors. See the Zephyr commit reference for the full diff.

Workarounds

Avoid calling k_queue_peek_head() and k_queue_peek_tail() from CONFIG_USERSPACE threads on shared queues until the patch is applied.
Serialize peek callers against queue consumers at the application layer using an external mutex or spinlock around peek and get operations on the same queue.
Disable SMP where feasible and reduce preemption points around queue operations if operational constraints allow.

bash

# Fetch and apply the upstream fix
git fetch origin
git cherry-pick a6b6149a50cb0f64061869f7536acbf80ccc5e0c
west build -b <board> <app> --pristine