{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","product":"zephyr","source":"CNA: zephyr","vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"2.0.0","versionType":"semver"},{"lessThan":"4.4.2","status":"affected","version":"4.4.0","versionType":"semver"}]}],"cveId":"CVE-2026-11812","cwes":["CWE-362"],"description":"The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds[1]. Access to ctx was not serialized, and prepare_fds() wrote ctx.fds[ctx.nfds] and incremented ctx.nfds with no bounds check.\n\nTwo independent paths mutate ctx concurrently: the background autohandler running on the system workqueue, and user-triggered operations reached through the updatehub run shell command, direct API calls, or — since the operations are exposed as syscalls — userspace threads. When a second flow enters prepare_fds() while ctx.nfds is already 1, the write lands one element past the array; by struct layout it overlaps the adjacent ctx.sock/ctx.nfds members. More broadly, the unsynchronized sharing lets two flows interleave connection setup and teardown, double-closing a socket descriptor or scribbling the shared buffers.\n\nThe result is corruption of the update subsystem's internal state and denial of service of the firmware-update path; the out-of-bounds write is contained within the ctx structure and there is no demonstrated path to memory outside it or to code execution. Triggering requires a local actor able to invoke update operations (or, with CONFIG_USERSPACE, an unprivileged userspace thread) and to win a timing race against the background handler; remote peers cannot control the race timing. The fix serializes the entry points with a mutex and adds a bounds check to prepare_fds().","epss":{"date":"2026-11-03","percentile":0.01014,"score":0.00104},"exploits":[],"kev":null,"metrics":[{"score":2.5,"severity":"low","source":"CNA: zephyr","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},{"score":2.5,"severity":"low","source":"NVD: vulnerabilities@zephyrproject.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1793769510557,"publishedAt":1786403357542,"references":[{"source":"CNA: zephyr","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159"},{"source":"CNA: zephyr","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vprh-rff6-46xp"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vprh-rff6-46xp"}],"remediation":[{"kind":"fix","source":"CNA: zephyr","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159"}],"revision":"a8483ea140ef8732f9155c4301870cad1a47d021b97114871d39538dcc04924d","sources":[{"modifiedAt":1793768355164,"name":"CNA: zephyr","retrievedAt":1793768968818,"url":"https://www.cve.org/CVERecord?id=CVE-2026-11812"},{"modifiedAt":1793769510557,"name":"NVD","retrievedAt":1793772953559,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11812"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793768988226,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-11812"}],"ssvc":{"assessedAt":1786560666812,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"UpdateHub: race condition on shared context causes out-of-bounds write and DoS","updatedAt":1793772953559}