Zephyr's dynamic kernel-object disposal routine releases the storage of a dynamically allocated and armed timer without canceling its timeout, leaving a dangling node in the global timeout queue. When the timer later expires, the timeout handler operates on the freed memory, corrupting the kernel heap in interrupt-service context. This deterministic use‑after‑free provides a sandbox‑escape memory‑corruption vector that allows a privileged escalation from an unprivileged userspace thread.

The vulnerability affects the Zephyr RTOS kernel when CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS are enabled. No specific affected version range is provided, so any build using these configuration options and the legacy timer cleanup logic is potentially susceptible.

The CVSS score of 8.8 indicates a high‑severity flaw, and the EPSS score is not available, implying insufficient publicly known exploitation data. The vulnerability is not listed in CISA KEV. An attacker who can drop the last reference on a timer and then cause the timer to expire can trigger the memory corruption while the kernel is privileged, enabling a privilege escalation. The deterministic nature of the flaw and the lack of defenses make exploitation likely if an attacker can control timer lifecycle.