{"id":"CVE-2026-11812","summary":"UpdateHub: race condition on shared context causes out-of-bounds write and DoS","details":"The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds[1]. Access to ctx was not serialized, and prepare_fds() wrote ctx.fds[ctx.nfds] and incremented ctx.nfds with no bounds check.\n\nTwo independent paths mutate ctx concurrently: the background autohandler running on the system workqueue, and user-triggered operations reached through the updatehub run shell command, direct API calls, or — since the operations are exposed as syscalls — userspace threads. When a second flow enters prepare_fds() while ctx.nfds is already 1, the write lands one element past the array; by struct layout it overlaps the adjacent ctx.sock/ctx.nfds members. More broadly, the unsynchronized sharing lets two flows interleave connection setup and teardown, double-closing a socket descriptor or scribbling the shared buffers.\n\nThe result is corruption of the update subsystem's internal state and denial of service of the firmware-update path; the out-of-bounds write is contained within the ctx structure and there is no demonstrated path to memory outside it or to code execution. Triggering requires a local actor able to invoke update operations (or, with CONFIG_USERSPACE, an unprivileged userspace thread) and to win a timing race against the background handler; remote peers cannot control the race timing. The fix serializes the entry points with a mutex and adds a bounds check to prepare_fds().","aliases":["GHSA-vprh-rff6-46xp"],"modified":"2026-08-12T15:33:25.503750Z","published":"2026-08-10T23:09:17.542Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11812.json","cna_assigner":"zephyr","cwe_ids":["CWE-362"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11812.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vprh-rff6-46xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11812"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"7c0ec4358a205f83d2c6cc91d6dfc0a3106989a4"},{"fixed":"551d3f92b36e9604f039101c4e4f623682d02159"}],"database_specific":{"extracted_events":[{"introduced":"2.0.0"},{"last_affected":"4.4.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0","v4.0.0-rc3","v4.0.0-rc2","v4.0.0-rc1","v3.7.0","v3.7.0-rc3","v3.7.0-rc2","v3.7.0-rc1","v3.6.0","v3.6.0-rc3","v3.6.0-rc2","v3.6.0-rc1","zephyr-v3.5.0","v3.5.0","v3.5.0-rc3","v3.5.0-rc2","v3.5.0-rc1","zephyr-v3.4.0","v3.4.0","v3.4.0-rc3","v3.4.0-rc2","v3.4.0-rc1","zephyr-v3.3.0","v3.3.0","v3.3.0-rc3","v3.3.0-rc2","v3.3.0-rc1","zephyr-v3.2.0","v3.2.0","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","zephyr-v3.1.0","v3.1.0","v3.1.0-rc3","v3.1.0-rc2","v3.1.0-rc1","zephyr-v3.0.0","v3.0.0","v3.0.0-rc3","v3.0.0-rc2","v3.0.0-rc1","v2.7.99","v2.7.0-rc3","v2.7.0-rc2","v2.7.0-rc1","zephyr-v2.6.0","v2.6.0","v2.6.0-rc3","v2.6.0-rc2","v2.6.0-rc1","zephyr-v2.5.0","v2.5.0","v2.5.0-rc4","v2.5.0-rc3","v2.5.0-rc2","v2.5.0-rc1","zephyr-v2.4.0","v2.4.0","v2.4.0-rc3","v2.4.0-rc2","v2.4.0-rc1","zephyr-v2.3.0","v2.3.0","v2.3.0-rc2","v2.3.0-rc1","zephyr-v2.1.0","v2.1.0","zephyr-v2.2.0","v2.2.0","v2.2.0-rc3","v2.2.0-rc2","v2.2.0-rc1","v2.1.0-rc3","v2.1.0-rc2","v2.1.0-rc1","zephyr-v2.0.0","v2.0.0"],"database_specific":{"vanir_signatures_modified":"2026-08-12T15:33:25Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"294587248619726562025221652170856107318","length":4959},"id":"CVE-2026-11812-255775dc","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159","target":{"file":"subsys/mgmt/updatehub/updatehub.c","function":"z_impl_updatehub_probe"}},{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159","target":{"file":"subsys/mgmt/updatehub/updatehub.c","function":"start_coap_client"},"deprecated":false,"digest":{"function_hash":"90390341905278207672527683324030983002","length":1639},"id":"CVE-2026-11812-2b650dd6","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"234815872844516966180317184793611664553","length":1158},"id":"CVE-2026-11812-925a0d2e","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159","target":{"file":"subsys/mgmt/updatehub/updatehub.c","function":"z_impl_updatehub_update"}},{"digest":{"function_hash":"159706866402720961937205787107872426042","length":168},"id":"CVE-2026-11812-acf785a4","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159","target":{"file":"subsys/mgmt/updatehub/updatehub.c","function":"z_impl_updatehub_report_error"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["114153474738938680265873417264502682009","234798587118357907629284456993494576645","98636082065895410438682071314923777472","115774604475404531453775739272612613389","61951140117615821695520639487881717130","200866947700592203058884783661521435383","270091390474901563048348542006051995825","37206194141144118879755886852764024836","276977820793394818031901061766250383224","145445182768260832523300703072160435869","87259050255054130828987786494331832650","200007237898613390430693645057684876583","333895066350859362690782165332001683508","273574333221847825942217516021786892261","267147663865896817504381410382658849837","239119243008339228137719818208994609213","320018282344936067063270714636191728776","315812726786731067000958500115415321268","14487120994937462784750864622296518204","304414074473712471480459141293488512827","264426177107465450377673334343753951493","198243441956880820048396327198604553376","17115527657405065683352953805628350593","92780725955016835158604999131810310607","256092476497252540515241761235903811927","16770366230312134707223467352542520420","98541671355883589185885843467104234678","60757914222365965331763488953394836482","320055502682678192874973026009636184720","182004020209433329769759852380222337033","184696391274146443223510462087068589552","240969212796011637407601968222074854778","166576092480847544033802780320356331373","107052523537371962776084108436290487007","112394782719186862257757207211253554834","141131603618301468610652311649823237136","100564064286611357069247322398849808987","232186768874133733578096762607514232638","269783008445103390523528218638857184558","210385035929395719275663914449024517170","251839467674834406046677698163234367837","7411025172704341739663857886400856991","320144079289548117230367281701091627802","245293097408862970481316294469671553971","68702819974133895611866972003485672918","246225356767729579902543249736279597495","126601558911229002324358596851059990219","172566519580138305321572887363363959170","10900402354629339612588534465485596342","291860345949616212202766757518598842230","57676880229240702649086900985339662781","291338451658354954033316720405279364856","284567427898928817380306593518878759473","272608805167751114238163778540893327928","94650765812623286406940672499137666541"],"threshold":0.9},"id":"CVE-2026-11812-e2339988","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159","target":{"file":"subsys/mgmt/updatehub/updatehub.c"}},{"digest":{"length":147,"function_hash":"336515225047557298297971138132527985246"},"id":"CVE-2026-11812-eebd56b5","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159","target":{"function":"prepare_fds","file":"subsys/mgmt/updatehub/updatehub.c"},"deprecated":false}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-11812.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}]}