Zephyr RTOS EUVD-2026-40367

Exploitation requires two concrete prerequisites drawn from the description: (1) genuine concurrency - either a CONFIG_SMP build with buffer holders on different CPUs, or a single-core build where preemption lands between the non-atomic refcount load and store while another context unrefs the same buffer; and (2) an application architecture that shares one net_buf among multiple independent unref'ers (e.g. buffers passed via k_fifo, zbus multi-subscriber delivery, or the IP stack RX/TX path with CONFIG_NET_BUF_FIXED_DATA_SIZE=n). The double-free of the underlying data block additionally requires a heap/variable-data pool (mem_pool_data_unref/heap_data_unref) as used by zbus, capture, WireGuard, ISO-TP and usbip; fixed-data pools (Bluetooth, default networking) instead suffer free-list corruption via the per-header refcount. Limiting factors that reduce realistic risk: the trigger is a refcount/timing race, not attacker-controlled packet content, so an external attacker has at most weak indirect influence over the race window; single-owner or lock-serialized unref designs are not affected; and the window demands precise timing (reflected in AC:H).

This is a genuine memory-safety defect but a lower operational priority than its 8.1 base score suggests. The published CVSS vector is AV:N/AC:H/PR:N/UI:N with C:H/I:H/A:H, yet the description is explicit that the trigger is a refcount/timing race, not packet content, and that an external attacker has 'at most weak indirect influence over the race window' - so AV:N (network) overstates attacker reachability, and a local/architecture-gated assessment (AV:L) is more faithful. Corroborating signals agree: EPSS is 0.16% (6th percentile), SSVC records Exploitation: none, Automatable: no, Technical Impact: partial, there is no CISA KEV listing and no public PoC. Exploitation is doubly gated - it requires (1) genuine concurrency (SMP, or single-core preemption at the exact non-atomic window) and (2) an application architecture that shares one buffer among multiple independent unref'ers. The high AC:H correctly reflects the required timing precision. Conflict to verify with the vendor: CVSS advertises a network vector while the description indicates the race is not attacker-content-controlled - treat this as an internal reliability/robustness hazard (crashes, heap corruption) more than a remotely weaponizable RCE primitive.

On an SMP-enabled Zephyr device, two threads each hold a reference to the same net_buf received via k_fifo (for example a zbus message delivered to multiple subscribers); both call net_buf_unref() at nearly the same instant, read the same prior refcount, and both perform the final free, double-freeing the heap data block and corrupting heap metadata. The resulting use-after-free/heap corruption can crash the device or, with careful heap grooming, be steered toward memory disclosure or control-flow corruption. No public PoC is identified, and because the race is timing-driven rather than packet-content-driven (AV network but AC high), an external party has only weak, indirect influence over when the window occurs.