Concurrency Issue in Zephyr's UpdateHub Management Subsystem

CVE-2026-11812

What is CVE-2026-11812?

A concurrency vulnerability exists in the UpdateHub management subsystem of Zephyr OS, where access to the context structure is not properly serialized. This oversight allows concurrent mutations from the background autohandler and user-triggered operations. Specifically, during the execution of the prepare_fds() function, an unsynchronized access leads to potential out-of-bounds writes, corrupting the internal state of the update subsystem and causing denial of service for firmware updates. The issue requires a local actor to trigger update operations and exploit a timing race, making it possible for unprivileged userspace threads on CONFIG_USERSPACE systems to affect the outcome.

References