AIKIDO-2026-933208

TL;DR

The kernel queue peek helpers read and dereference a node taken from a queue's internal list without holding the queue spinlock, while other accessors that unlink and free nodes operate under that lock. On SMP builds or under preemption a concurrent queue get can free the node between the peek obtaining and dereferencing the pointer. The peek then reads flag bits and a data pointer from freed, possibly reallocated memory and returns a stale or dangling pointer to its caller, which can leak heap contents or crash the system when the pointer is later used. The fix wraps both peek implementations in the queue spinlock so the read and dereference are atomic with the concurrent free.