CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal

Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...