CVE-2026-10653: Zephyr RTOS Race Condition Vulnerability

CVE-2026-10653 Overview

CVE-2026-10653 is a race condition vulnerability in the Zephyr RTOS net_buf library (lib/net_buf/buf.c). The library manipulated both the per-header buf->ref counter and the per-data-block ref_count using plain non-atomic C operators. Under genuine concurrency on SMP systems or single-core preemption, two holders can observe the same prior reference value and both conclude they hold the last reference. This produces a double free of heap-allocated data blocks [CWE-415] or a corrupted pool free list. The flaw affects all Zephyr releases through v4.4.0.

Critical Impact
Double free of heap data blocks in mem_pool_data_unref/heap_data_unref corrupts heap metadata and enables use-after-free conditions. Fixed-data pools used by Bluetooth and networking stacks can hand the same buffer to two owners after free-list corruption.

Affected Products

Zephyr RTOS releases through v4.4.0
Applications using zbus message subscribers, IP stack RX/TX buffers with CONFIG_NET_BUF_FIXED_DATA_SIZE=n
Subsystems including capture, WireGuard, ISO-TP, and usbip

Discovery Timeline

2026-06-30 - CVE-2026-10653 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-10653

Vulnerability Analysis

The net_buf API is documented as self-synchronizing. Callers may share one buffer across threads via k_fifo and each holder independently calls net_buf_unref() without external locking. The reference count operations buf->ref++, if (--buf->ref > 0), and if (--(*ref_count)) compile to non-atomic load-modify-store sequences. On SMP hardware or when preemption occurs between the load and store, two threads can race and both observe the same reference count.

For variable-data and heap pools, the outcome is a double k_heap_free() or k_free() on the same block. This corrupts heap metadata and triggers a use-after-free against the heap-hardening poison pattern. For per-header refcount races on any pool type, including fixed-data pools used by Bluetooth and networking, the buffer is pushed to the free LIFO twice. A later allocation then returns the same buffer to two independent owners.

Root Cause

The root cause is missing atomicity on reference count updates in a data structure whose API contract promises thread-safe reference management. The uint8_t ref field and uint8_t *ref_count pointer were mutated with plain C operators rather than atomic primitives.

Attack Vector

The trigger is a timing race rather than packet content. An external attacker has only weak indirect influence over the race window through traffic pacing. Exploitation requires an application architecture that shares one buffer among multiple independent unref callers and genuine concurrent execution.

 	/** Fragments associated with this buffer. */
 	struct net_buf *frags;
 
-	/** Reference count. */
-	uint8_t ref;
+	/** Reference count, packed alongside three adjacent uint8_t
+	 *  fields (`flags`, `pool_id`, `user_data_size`) in a single
+	 *  atomic_t-sized slot.
+	 *
+	 * `ref_word` is the atomic_t view used by net_buf internals for
+	 * ref/unref; `ref`, `flags`, `pool_id` and `user_data_size` are
+	 * byte-level views into the same storage.
+	 *
+	 * atomic_inc/dec on ref_word add/subtract 1 to/from the whole
+	 * word, but because the byte-struct layout below places `ref`
+	 * at the least-significant byte of `ref_word` regardless of
+	 * endianness, and because the ref count never overflows past
+	 * 254 (already implicit in its uint8_t domain), only the ref
+	 * byte changes -- the other three bytes are untouched.
+	 */

Source: Zephyr commit 9bb2878319d5f46c29ab5fe855a378d87cd75fc3. The patch converts both refcounts to atomic_inc/atomic_dec operations by overlaying buf->ref in an atomic_t-sized union and changing the data-block refcount from uint8_t to atomic_t.

Detection Methods for CVE-2026-10653

Indicators of Compromise

Kernel panics or asserts referencing k_heap metadata corruption on Zephyr devices under network or Bluetooth load
Heap-hardening poison pattern violations reported during net_buf unref paths
Duplicate buffer pointers observed by two unrelated subsystems, indicating free-list corruption

Detection Strategies

Enable CONFIG_KERNEL_COHERENCE and heap sentinels to catch double-free conditions at runtime
Instrument net_buf_unref with debug logging on affected releases to trace reference count transitions
Run stress tests on SMP builds with concurrent producers and consumers sharing buffers via k_fifo

Monitoring Recommendations

Monitor Zephyr device telemetry for unexpected reboots, watchdog resets, or fault handlers triggered from network or Bluetooth threads
Track firmware versions across fleets and flag devices running Zephyr through v4.4.0
Correlate crash dumps against net_buf.c and k_heap_free call sites

How to Mitigate CVE-2026-10653

Immediate Actions Required

Upgrade to a Zephyr release containing commit 9bb2878319d5f46c29ab5fe855a378d87cd75fc3 that converts refcount fields to atomic_t
Inventory embedded devices and firmware images built against Zephyr releases through v4.4.0
Prioritize devices running zbus subscribers, WireGuard, ISO-TP, usbip, or IP stacks with CONFIG_NET_BUF_FIXED_DATA_SIZE=n

Patch Information

The fix is available in the upstream Zephyr repository. See the GitHub Security Advisory GHSA-284j-5jm9-55hh for the coordinated disclosure and the upstream commit that makes both reference counts atomic.

Workarounds

Restructure applications so that a single owner holds each net_buf and avoid sharing buffers across threads that independently call net_buf_unref()
Wrap net_buf_ref/net_buf_unref call sites with an application-level mutex or spinlock until the patched release is deployed
Disable optional subsystems that pass buffers between independent unref contexts, such as zbus subscribers, where feasible

bash

# Verify patched Zephyr source contains atomic refcount
grep -n "atomic_t ref_word" include/zephyr/net_buf.h
git log --oneline | grep 9bb2878319d5f46c29ab5fe855a378d87cd75fc3