CVE-2026-12366 is a use-after-free in Zephyr's timer subsystem that exposes a fundamental mismatch between how dynamic kernel objects are disposed and how timers manage internal state. When a user thread drops permissions on an armed timer, k_object_release() attempts to free the timer object without checking whether it contains a dnode still linked into the global _timeout_q. The disposal switch handles MSGQ and STACK but has no TIMER case — the timer gets freed while its timeout entry remains queued. When the timer subsequently expires, the handler dereferences the freed object from ISR context, giving the attacker controlled kernel heap corruption.
The root cause isn't a single missed case — it's that the disposal path was designed assuming objects arrive in a quiescent state. MSGQ and STACK don't have temporal state; TIMER does. The dnode lives in a global queue that every timer expiration walks, making this far more severe than a typical UAF: one missing handler poisons the timeout infrastructure for all timers.
You should audit every other K_OBJ type in the dynamic system for equivalent embedded kernel state — specifically, any object that registers pointers into global datastructures during initialization. The fix (k_timer_cleanup with wait-for-in-flight-handlers semantics) is correct for the UAF but introduces a new risk: a malicious user thread can arm a timer, release permissions, and force cleanup code to block indefinitely waiting for a handler that may never expire. This is a priority inversion that needs explicit handling in your threat model.
On deployed Zephyr devices, remember that the patch may never arrive. The CVSS score describes severity on a system that gets updated — embedded devices often lack any update mechanism, meaning this vulnerability could persist on hardware in the field well after the fix is public.