A kernel timer is a scheduled callback mechanism inside the operating system kernel. It lets the kernel run a function later, or at regular intervals, without waiting in a busy loop. Timers are common in networking, storage, power management, and protocol state machines, where the kernel must react to timeouts or periodic housekeeping.
Kernel timers matter in cyber security because they are asynchronous: the callback may run long after the code that scheduled it has moved on. If an object is freed before its timer is cancelled, the callback can follow a stale pointer and trigger a use-after-free. Attackers look for these timing mistakes because they can lead to crashes, memory corruption, or, in some cases, code execution. Defenders focus on strict teardown order, safe cancellation, and careful review of any kernel path that mixes timers with object lifetimes.