CVE-2026-11812

Received Received - Intake

Race Condition in Zephyr RTOS UpdateHub Subsystem

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Zephyr Project

Description

The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds[1]. Access to ctx was not serialized, and prepare_fds() wrote ctx.fds[ctx.nfds] and incremented ctx.nfds with no bounds check. Two independent paths mutate ctx concurrently: the background autohandler running on the system workqueue, and user-triggered operations reached through the updatehub run shell command, direct API calls, or — since the operations are exposed as syscalls — userspace threads. When a second flow enters prepare_fds() while ctx.nfds is already 1, the write lands one element past the array; by struct layout it overlaps the adjacent ctx.sock/ctx.nfds members. More broadly, the unsynchronized sharing lets two flows interleave connection setup and teardown, double-closing a socket descriptor or scribbling the shared buffers. The result is corruption of the update subsystem's internal state and denial of service of the firmware-update path; the out-of-bounds write is contained within the ctx structure and there is no demonstrated path to memory outside it or to code execution. Triggering requires a local actor able to invoke update operations (or, with CONFIG_USERSPACE, an unprivileged userspace thread) and to win a timing race against the background handler; remote peers cannot control the race timing. The fix serializes the entry points with a mutex and adds a bounds check to prepare_fds().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-11812

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	updatehub	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability involves a race condition in the UpdateHub management subsystem where concurrent access to a shared context structure (ctx) leads to memory corruption. The issue occurs because the structure's fields are modified without proper synchronization, causing an out-of-bounds write that corrupts adjacent members like socket descriptors and counters. This results in denial of service for firmware updates but does not allow code execution or memory access outside the structure.

Detection Guidance

This vulnerability involves a race condition in the UpdateHub management subsystem, which may not have direct detection commands. Monitor system logs for updatehub errors or crashes, and check for unusual socket descriptor handling or state corruption in the update subsystem. No specific commands are provided in the context.

Impact Analysis

The impact is limited to denial of service for firmware updates on affected systems. An attacker with local access could trigger a timing race to corrupt the update subsystem's state, preventing legitimate updates. Remote exploitation is not possible as the race requires local interaction with the vulnerable component.

Mitigation Strategies

Apply the official patch from the Zephyr project that adds mutex serialization and bounds checking to the UpdateHub subsystem. Restrict local access to update operations if possible, and ensure only trusted users can trigger updates to reduce exposure to the race condition.

Hi! I’m here to help you understand CVE-2026-11812. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70