Zephyr kernel vulnerabilities

A race condition in the Zephyr kernel affects z_waitq_head(), which on SMP systems reads the head of a thread wait queue without holding the _sched_spinlock. The race between timer expiration handling and thread abort can cause out-of-bounds and use-after-free writes in supervisor context plus scheduler state corruption.

A vulnerability in the Zephyr kernel affects the k_thread_join() and k_thread_abort() system calls. An error in access validation (thread_obj_validate()) allows an unprivileged user thread to invoke these functions on a thread object it does not own. Instead of terminating the offending thread, execution reaches undefined behavior, potentially causing a kernel crash (on Clang) or an access-control bypass (on GCC).

A vulnerability in the Zephyr kernel's z_queue_node_peek() in kernel/queue.c reads a node from the data_q list without holding the queue spinlock. A concurrent k_queue_get() can free the node during the operation, leading to use-after-free and a dangling pointer. This affects k_fifo and k_lifo queues used in net_buf, Bluetooth, USB, and networking subsystems.