CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16148

CVE-2026-16148 affects the ITE it82xx2 USB device-controller driver in Zephyr RTOS (drivers/usb/udc/udc_it82xx2.c). The root cause is that k_work_init_delayable() is called inside it82xx2_enable(), which unconditionally overwrites the delayable work structure without a busy check . Because it82xx...

CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

EUVD-2026-58751

A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...

CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race

A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...

CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race

A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...

CVE-2026-12365

CVE-2026-12365 describes a kernel-use-after-free in Zephyr’s second-generation work queue (kernel/work.c) related to delayable work timeouts. If a delayable work item’s timeout has been dequeued and its handler work_timeout() is in flight, a concurrent cancellation can race, allowing a freed slot...

CVE-2026-12365 Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race

A use-after-free exists in the Zephyr second-generation work queue kernel/work.c in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler worktimeout is in flight blocked acquiring the work-queue spinlock, a concurrent cancellation does no...