CVE-2026-11811 Overview
CVE-2026-11811 is a socket descriptor leak in the Zephyr RTOS UpdateHub over-the-air (OTA) update client. The flaw resides in start_coap_client() within subsys/mgmt/updatehub/updatehub.c. Connection-setup failure paths never call cleanup_connection() because a gating flag (ret > 0) is falsified before the socket is opened. Each failed attempt to reach the UpdateHub server permanently leaks one descriptor from the shared socket and net_context pool. Once the pool is exhausted, device-wide networking degrades until reboot. The issue is tracked as CWE-772: Missing Release of Resource after Effective Lifetime.
Critical Impact
Repeated OTA connection failures exhaust the shared socket pool, producing a device-wide denial-of-service condition on Zephyr builds with the UpdateHub client enabled.
Affected Products
- Zephyr RTOS builds with CONFIG_UPDATEHUB enabled
- Zephyr UpdateHub OTA client (subsys/mgmt/updatehub/updatehub.c)
- Deployments using UpdateHub with or without DTLS (CONFIG_UPDATEHUB_DTLS)
Discovery Timeline
- 2026-08-10 - CVE-2026-11811 published to the National Vulnerability Database
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-11811
Vulnerability Analysis
The UpdateHub client opens a UDP socket with zsock_socket() and stores the descriptor in the global ctx.sock. On failure paths, a shared error: label calls cleanup_connection() only when ret > 0. The code sets ret = -1 immediately after socket creation, so subsequent failures in zsock_setsockopt() (DTLS configuration) or zsock_connect() skip cleanup. The open descriptor in ctx.sock is overwritten by the next attempt, leaking the prior descriptor permanently.
Root Cause
The root cause is a logic error in resource-cleanup gating [CWE-772]. The flag intended to signal "socket successfully created and must be closed on error" is cleared before the failure-prone setup steps execute. This leaves no reachable path to zsock_close() when DTLS setup or connect fails, even though the descriptor is live.
Attack Vector
The failing setup path is reached whenever the OTA client cannot establish a connection. This occurs automatically via the periodic autohandler() poll, on demand through the updatehub_probe() and updatehub_update() APIs, or via the updatehub run shell command. A network or on-path attacker can trigger the leak by dropping, resetting, or otherwise disrupting DTLS traffic to the UpdateHub server. Natural network outages produce the same effect. The default poll interval bounds the leak rate to roughly one descriptor per 24 hours per device.
return false;
}
- ret = 1;
-
ctx.sock = zsock_socket(addr->ai_family, NET_SOCK_DGRAM, protocol);
if (ctx.sock < 0) {
LOG_ERR("Failed to create UDP socket");
goto error;
}
- ret = -1;
-
#if defined(CONFIG_UPDATEHUB_DTLS)
if (zsock_setsockopt(ctx.sock, ZSOCK_SOL_TLS, ZSOCK_TLS_SEC_TAG_LIST,
sec_list, sizeof(sec_list)) < 0) {
Source: Zephyr Project GitHub commit 29e34765. The patch removes the premature ret = 1 and ret = -1 assignments so the existing cleanup gate correctly closes the socket on all failure paths.
Detection Methods for CVE-2026-11811
Indicators of Compromise
- Recurring LOG_ERR entries from the UpdateHub subsystem indicating failed zsock_setsockopt() or zsock_connect() calls without corresponding cleanup log lines.
- Steady decline in available entries in the Zephyr socket or net_context pool over time on devices with CONFIG_UPDATEHUB enabled.
- Networking functions across the device beginning to fail after prolonged uptime, resolved only by reboot.
Detection Strategies
- Instrument net_context and socket pool usage counters and alert on monotonically increasing consumption on UpdateHub-enabled builds.
- Correlate UpdateHub connection-failure log events with subsequent socket allocation failures elsewhere in the firmware.
- Review firmware images for the presence of the unpatched start_coap_client() sequence in subsys/mgmt/updatehub/updatehub.c.
Monitoring Recommendations
- Track device uptime alongside OTA connection-failure counts; devices with high failure rates and long uptime are at greatest risk.
- Monitor UpdateHub server reachability from device fleets and treat sustained connectivity loss as an operational risk indicator for this leak.
- Log and centralize Zephyr subsystem messages so socket pool exhaustion events can be detected across the fleet.
How to Mitigate CVE-2026-11811
Immediate Actions Required
- Rebuild affected Zephyr firmware against a tree that includes commit 29e34765 and redeploy to devices with CONFIG_UPDATEHUB enabled.
- Audit device fleets for uptime and OTA failure telemetry; schedule reboots for devices likely to have accumulated leaked descriptors.
- Verify UpdateHub server availability and network paths to reduce the rate of connection-setup failures until patched firmware is deployed.
Patch Information
The fix is applied in the Zephyr Project via commit 29e3476501a65c0bcd469abd275749d324008ce2 and is documented in GHSA-q3mh-4wj7-mq7f. The patch removes the incorrect ret assignments so cleanup_connection() runs on every failure path in start_coap_client().
Workarounds
- Disable CONFIG_UPDATEHUB in firmware builds where OTA updates via UpdateHub are not required.
- Increase the OTA poll interval to reduce the leak rate until patched firmware can be deployed.
- Schedule periodic reboots on devices that must run vulnerable builds to reclaim leaked descriptors from the shared pool.
# Disable the UpdateHub client in the Zephyr build configuration
# In prj.conf:
CONFIG_UPDATEHUB=n
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
