CVE-2026-12365: Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race

A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout() is in flight (blocked acquiring the work-queue spinlock), a concurrent cancellation does not wait for that handler to finish. In unschedulelocked() the pre-fix code called zaborttimeout(), which for an already-announcing record returns -EINVAL without removing it; cancelasynclocked() then observes the work as idle, so even kworkcanceldelayablesync() and kworkflushdelayable() return without blocking on the in-flight handler.

Because those are the APIs the kernel header documents as the safe way to cancel before freeing a kworkdelayable, a caller that frees the object immediately after a successful sync cancel can race the still-pending handler. worktimeout() subsequently dereferences the freed record: it reads to->dticks via zistimeouthandlercanceled() and, if the freed slot has been reused so the bail check fails, performs a read-modify-write of wp->flags (KWORKDELAYEDBIT) and submits work against a stale dw->queue pointer — a use-after-free read and write.

The kwork API is kernel-mode only (no syscall entry point), so this is a kernel-internal concurrency defect rather than a userspace privilege escalation. Triggering it requires an SMP build and a subsystem that schedules and then frees (or reschedules) a delayable work item in the narrow window while its timeout is announcing; an attacker able to influence the timing of such teardown (for example via connection churn driving subsystem timers) has a plausible but probabilistic path. The impact is kernel memory corruption or crash (denial of service).

The fix makes unschedulelocked() wait, by spinning on ztryaborttimeout() returning -EAGAIN while releasing and re-acquiring the work spinlock, until any in-flight handler completes before returning, and switches worktimeout() to atomic KWORKDELAYEDBIT ownership. This closes both the free-then-handler use-after-free and the related reschedule early-fire race.