ZephyrProject Zephyr up to 4.4.1 UpdateHub Management Subsystem updatehub.c prepare_fds memory corruption

Summaryinfo

A vulnerability categorized as problematic has been discovered in ZephyrProject Zephyr up to 4.4.1. Affected by this vulnerability is the function prepare_fds of the file subsys/mgmt/updatehub/updatehub.c of the component UpdateHub Management Subsystem. The manipulation results in memory corruption. This vulnerability was named CVE-2026-11812. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ZephyrProject Zephyr up to 4.4.1. Affected is the function prepare_fds of the file subsys/mgmt/updatehub/updatehub.c of the component UpdateHub Management Subsystem. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on integrity, and availability. CVE summarizes:

The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the CoAP block context, payload buffer, status code, socket, and a one-element poll-fd array fds[1]. Access to ctx was not serialized, and prepare_fds() wrote ctx.fds[ctx.nfds] and incremented ctx.nfds with no bounds check. Two independent paths mutate ctx concurrently: the background autohandler running on the system workqueue, and user-triggered operations reached through the updatehub run shell command, direct API calls, or — since the operations are exposed as syscalls — userspace threads. When a second flow enters prepare_fds() while ctx.nfds is already 1, the write lands one element past the array; by struct layout it overlaps the adjacent ctx.sock/ctx.nfds members. More broadly, the unsynchronized sharing lets two flows interleave connection setup and teardown, double-closing a socket descriptor or scribbling the shared buffers. The result is corruption of the update subsystem's internal state and denial of service of the firmware-update path; the out-of-bounds write is contained within the ctx structure and there is no demonstrated path to memory outside it or to code execution. Triggering requires a local actor able to invoke update operations (or, with CONFIG_USERSPACE, an unprivileged userspace thread) and to win a timing race against the background handler; remote peers cannot control the race timing. The fix serializes the entry points with a mutex and adds a bounds check to prepare_fds().

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-11812 since 06/09/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Applying the patch 551d3f92b36e9604f039101c4e4f623682d02159 is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ZephyrProject

Name

• Zephyr

Version

• 4.4.0
• 4.4.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion