Concurrency Vulnerability in Zephyr Net_buf Library by Zephyr Project

CVE-2026-10653

What is CVE-2026-10653?

The Zephyr net_buf library contains a concurrency vulnerability due to the manipulation of reference counts using non-atomic operations, allowing multiple callers to possibly free the same memory block concurrently. This can lead to heap metadata corruption and use-after-free conditions when shared buffers are referenced by multiple threads. The flaw is particularly evident in applications utilizing shared buffers across unref'ers, triggering a race condition that may allow attackers to exploit the concurrency window indirectly, thereby increasing the risk of memory mismanagement. The fix involves upgrading reference counts to utilize atomic operations, effectively mitigating the risks associated with concurrent access.

References