CVE-2026-78118 Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

The kernel helper zwaitqhead kernel/include/waitq.h reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock schedspinlock that serializes wait-queue mutation. The consequential call site is ztimerexpirationhandler in...