CVE-2026-11812

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11812
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-11812.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-11812
Aliases
  • GHSA-vprh-rff6-46xp
Published
2026-08-10T23:09:17.542Z
Modified
2026-08-12T15:33:25.503750Z
Severity
  • 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
UpdateHub: race condition on shared context causes out-of-bounds write and DoS
Details

The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds[1]. Access to ctx was not serialized, and prepare_fds() wrote ctx.fds[ctx.nfds] and incremented ctx.nfds with no bounds check.

Two independent paths mutate ctx concurrently: the background autohandler running on the system workqueue, and user-triggered operations reached through the updatehub run shell command, direct API calls, or — since the operations are exposed as syscalls — userspace threads. When a second flow enters prepare_fds() while ctx.nfds is already 1, the write lands one element past the array; by struct layout it overlaps the adjacent ctx.sock/ctx.nfds members. More broadly, the unsynchronized sharing lets two flows interleave connection setup and teardown, double-closing a socket descriptor or scribbling the shared buffers.

The result is corruption of the update subsystem's internal state and denial of service of the firmware-update path; the out-of-bounds write is contained within the ctx structure and there is no demonstrated path to memory outside it or to code execution. Triggering requires a local actor able to invoke update operations (or, with CONFIGUSERSPACE, an unprivileged userspace thread) and to win a timing race against the background handler; remote peers cannot control the race timing. The fix serializes the entry points with a mutex and adds a bounds check to preparefds().

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11812.json",
    "cwe_ids": [
        "CWE-362"
    ],
    "cna_assigner": "zephyr"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
7c0ec4358a205f83d2c6cc91d6dfc0a3106989a4
Fixed
551d3f92b36e9604f039101c4e4f623682d02159
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "4.4.1"
        }
    ]
}

Affected versions

v2.*
v2.0.0
v2.1.0
v2.1.0-rc1
v2.1.0-rc2
v2.1.0-rc3
v2.2.0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.3.0
v2.3.0-rc1
v2.3.0-rc2
v2.4.0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.5.0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.5.0-rc4
v2.6.0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.7.99
v3.*
v3.0.0
v3.0.0-rc1
v3.0.0-rc2
v3.0.0-rc3
v3.1.0
v3.1.0-rc1
v3.1.0-rc2
v3.1.0-rc3
v3.2.0
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.3.0
v3.3.0-rc1
v3.3.0-rc2
v3.3.0-rc3
v3.4.0
v3.4.0-rc1
v3.4.0-rc2
v3.4.0-rc3
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.5.0-rc3
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3
zephyr-v2.*
zephyr-v2.0.0
zephyr-v2.1.0
zephyr-v2.2.0
zephyr-v2.3.0
zephyr-v2.4.0
zephyr-v2.5.0
zephyr-v2.6.0
zephyr-v3.*
zephyr-v3.0.0
zephyr-v3.1.0
zephyr-v3.2.0
zephyr-v3.3.0
zephyr-v3.4.0
zephyr-v3.5.0

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2026-11812-255775dc",
        "deprecated": false,
        "digest": {
            "length": 4959.0,
            "function_hash": "294587248619726562025221652170856107318"
        },
        "signature_type": "Function",
        "target": {
            "function": "z_impl_updatehub_probe",
            "file": "subsys/mgmt/updatehub/updatehub.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-11812-2b650dd6",
        "deprecated": false,
        "digest": {
            "length": 1639.0,
            "function_hash": "90390341905278207672527683324030983002"
        },
        "signature_type": "Function",
        "target": {
            "function": "start_coap_client",
            "file": "subsys/mgmt/updatehub/updatehub.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-11812-925a0d2e",
        "deprecated": false,
        "digest": {
            "length": 1158.0,
            "function_hash": "234815872844516966180317184793611664553"
        },
        "signature_type": "Function",
        "target": {
            "function": "z_impl_updatehub_update",
            "file": "subsys/mgmt/updatehub/updatehub.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-11812-acf785a4",
        "deprecated": false,
        "digest": {
            "length": 168.0,
            "function_hash": "159706866402720961937205787107872426042"
        },
        "signature_type": "Function",
        "target": {
            "function": "z_impl_updatehub_report_error",
            "file": "subsys/mgmt/updatehub/updatehub.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-11812-e2339988",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "114153474738938680265873417264502682009",
                "234798587118357907629284456993494576645",
                "98636082065895410438682071314923777472",
                "115774604475404531453775739272612613389",
                "61951140117615821695520639487881717130",
                "200866947700592203058884783661521435383",
                "270091390474901563048348542006051995825",
                "37206194141144118879755886852764024836",
                "276977820793394818031901061766250383224",
                "145445182768260832523300703072160435869",
                "87259050255054130828987786494331832650",
                "200007237898613390430693645057684876583",
                "333895066350859362690782165332001683508",
                "273574333221847825942217516021786892261",
                "267147663865896817504381410382658849837",
                "239119243008339228137719818208994609213",
                "320018282344936067063270714636191728776",
                "315812726786731067000958500115415321268",
                "14487120994937462784750864622296518204",
                "304414074473712471480459141293488512827",
                "264426177107465450377673334343753951493",
                "198243441956880820048396327198604553376",
                "17115527657405065683352953805628350593",
                "92780725955016835158604999131810310607",
                "256092476497252540515241761235903811927",
                "16770366230312134707223467352542520420",
                "98541671355883589185885843467104234678",
                "60757914222365965331763488953394836482",
                "320055502682678192874973026009636184720",
                "182004020209433329769759852380222337033",
                "184696391274146443223510462087068589552",
                "240969212796011637407601968222074854778",
                "166576092480847544033802780320356331373",
                "107052523537371962776084108436290487007",
                "112394782719186862257757207211253554834",
                "141131603618301468610652311649823237136",
                "100564064286611357069247322398849808987",
                "232186768874133733578096762607514232638",
                "269783008445103390523528218638857184558",
                "210385035929395719275663914449024517170",
                "251839467674834406046677698163234367837",
                "7411025172704341739663857886400856991",
                "320144079289548117230367281701091627802",
                "245293097408862970481316294469671553971",
                "68702819974133895611866972003485672918",
                "246225356767729579902543249736279597495",
                "126601558911229002324358596851059990219",
                "172566519580138305321572887363363959170",
                "10900402354629339612588534465485596342",
                "291860345949616212202766757518598842230",
                "57676880229240702649086900985339662781",
                "291338451658354954033316720405279364856",
                "284567427898928817380306593518878759473",
                "272608805167751114238163778540893327928",
                "94650765812623286406940672499137666541"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "target": {
            "file": "subsys/mgmt/updatehub/updatehub.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2026-11812-eebd56b5",
        "deprecated": false,
        "digest": {
            "length": 147.0,
            "function_hash": "336515225047557298297971138132527985246"
        },
        "signature_type": "Function",
        "target": {
            "function": "prepare_fds",
            "file": "subsys/mgmt/updatehub/updatehub.c"
        },
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/551d3f92b36e9604f039101c4e4f623682d02159",
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-11812.json"
vanir_signatures_modified 
"2026-08-12T15:33:25Z"