Zephyr UpdateHub CVE-2026-11812

Exploitation requires a local actor - either an authenticated shell user able to run the 'updatehub run' command, a process invoking the updatehub API directly, or (with CONFIG_USERSPACE enabled) an unprivileged userspace thread with access to the updatehub syscalls. The attacker must also win a timing race against the background autohandler running on the system workqueue, which is a high-complexity precondition (AC:H) and cannot be controlled or influenced by a remote peer. Remote network attackers have no mechanism to trigger or time the race. The vulnerability is further constrained to Zephyr builds with CONFIG_UPDATEHUB=y; it is a compile-time dead code path in all other Zephyr configurations. No special network conditions or inbound connections are required - the race is entirely local to the embedded device's scheduling.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L and base score of 2.5 are well-calibrated for this issue: local access is mandatory, attack complexity is high because exploitation requires winning a timing race between two concurrent kernel-level flows, and the blast radius is confined to availability of the OTA update subsystem with no confidentiality or integrity impact. The vulnerability tags supplied with this advisory - 'RCE' and 'Buffer Overflow' - materially overstate the risk and conflict directly with the CVE description, which states explicitly that 'there is no demonstrated path to memory outside [the ctx structure] or to code execution'; those tags should be disregarded for prioritization purposes. No CISA KEV listing exists, no public exploit code has been identified, and the OOB write is structurally bounded within ctx, making reliable control-flow hijack implausible without additional memory-layout primitives that do not appear to be available here. The realistic operational risk is disruption of OTA firmware update capability on individual Zephyr-based devices - relevant for fleets relying on remote management but not a network-reachable threat. Patching is appropriate as part of normal maintenance cadence; no emergency response is warranted.

A local unprivileged process on a CONFIG_USERSPACE-enabled Zephyr device repeatedly invokes the updatehub_probe syscall in a tight loop while the background z_impl_updatehub_autohandler is concurrently executing on the system workqueue, racing both threads into prepare_fds() simultaneously. When both flows observe ctx.nfds == 1 before either increments it, one write lands at ctx.fds[1] - one past the array boundary - corrupting the adjacent ctx.sock or ctx.nfds field, after which the update subsystem enters an inconsistent state, double-closes a socket, or stalls, denying all subsequent OTA update operations until the device is rebooted.