CVE-2026-11812: UpdateHub Management Subsystem DoS Flaw

CVE-2026-11812 Overview

CVE-2026-11812 is a race condition [CWE-362] in the Zephyr RTOS UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c). The subsystem drives every update operation through a single file-scope ctx structure containing the CoAP block context, payload buffer, socket, and a one-element poll-fd array fds[1]. Access to ctx is not serialized, and prepare_fds() writes to ctx.fds[ctx.nfds] without a bounds check. Concurrent execution from the background autohandler and user-triggered update operations can drive an out-of-bounds write within the ctx structure and corrupt update-subsystem state.

Critical Impact
A local attacker who can invoke update operations, or an unprivileged userspace thread when CONFIG_USERSPACE is enabled, can win a timing race against the background handler to corrupt UpdateHub state and deny firmware updates.

Affected Products

Zephyr RTOS UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c)
Zephyr builds exposing UpdateHub through the updatehub run shell command or direct API
Zephyr builds with CONFIG_USERSPACE enabling syscall entry to UpdateHub operations

Discovery Timeline

2026-08-10 - CVE-2026-11812 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-11812

Vulnerability Analysis

The UpdateHub subsystem uses a single file-scope updatehub_context structure to hold state across the entire update workflow. This structure contains the CoAP block context, payload buffer, status code, socket descriptor, and a one-element poll-fd array fds[1] tracked by ctx.nfds. The subsystem does not serialize access to ctx, so multiple flows can enter its state machine concurrently.

Two execution paths mutate ctx at the same time. The background autohandler runs on the system workqueue, while user-triggered operations reach the same code through the updatehub run shell command, direct API calls, or syscalls invoked by userspace threads. When a second flow enters prepare_fds() while ctx.nfds is already 1, the write to ctx.fds[ctx.nfds] lands one element past the array. By struct layout, that write overlaps the adjacent ctx.sock and ctx.nfds members.

Beyond the bounded overflow, interleaved connection setup and teardown across flows can double-close a socket descriptor or scribble the shared payload buffers. The result is corruption of internal update state and denial of service on the firmware-update path.

Root Cause

The root cause is missing synchronization on a shared file-scope structure combined with an unchecked array index. prepare_fds() writes ctx.fds[ctx.nfds] and increments ctx.nfds without validating the index against the size of the one-element array.

Attack Vector

Triggering the flaw requires a local actor able to invoke update operations, or with CONFIG_USERSPACE, an unprivileged userspace thread issuing syscalls into UpdateHub. The attacker must win a timing race against the background autohandler. Remote CoAP peers cannot control race timing, so the flaw is not remotely exploitable. The out-of-bounds write is contained within ctx, and no path to memory outside the structure or to code execution has been demonstrated.

 static struct updatehub_context {
 	struct coap_block_context block;
-	struct k_sem semaphore;
 	struct updatehub_storage_context storage_ctx;
 	psa_hash_operation_t crypto_ctx;
 	enum updatehub_response code_status;

Source: GitHub Commit 551d3f9. The upstream fix replaces the prior semaphore-based scheme with a mutex serializing entry points and adds a bounds check to prepare_fds().

Detection Methods for CVE-2026-11812

Indicators of Compromise

Unexpected termination or hang of the UpdateHub background autohandler on the system workqueue.
Firmware update failures immediately after invocations of the updatehub run shell command or UpdateHub syscalls.
Socket errors referencing already-closed descriptors originating from UpdateHub code paths.

Detection Strategies

Audit Zephyr build configurations for CONFIG_UPDATEHUB and CONFIG_USERSPACE combinations that expose UpdateHub operations to unprivileged threads.
Review firmware for the presence of the fixed commit 551d3f9 in subsys/mgmt/updatehub/updatehub.c prior to release.
Instrument test builds with KASAN or equivalent to catch the out-of-bounds write in prepare_fds() during fuzzing of concurrent UpdateHub invocations.

Monitoring Recommendations

Log every UpdateHub entry point invocation and correlate with autohandler activity to surface racy patterns.
Monitor device fleets for repeated failed update attempts, which can signal exploitation attempts or crash loops.
Track shell command execution on devices where the UpdateHub shell interface is enabled in production.

How to Mitigate CVE-2026-11812

Immediate Actions Required

Apply the upstream Zephyr fix from commit 551d3f9 that serializes UpdateHub entry points with a mutex and bounds-checks prepare_fds().
Disable the UpdateHub shell command in production images where interactive update control is not required.
Restrict which userspace threads can invoke UpdateHub syscalls when CONFIG_USERSPACE is enabled.

Patch Information

The fix is available in the Zephyr project via the GitHub Security Advisory GHSA-vprh-rff6-46xp and the corresponding commit 551d3f92b36e9604f039101c4e4f623682d02159. Rebuild firmware images against a Zephyr tree that includes this commit and re-flash affected devices.

Workarounds

Build Zephyr without CONFIG_UPDATEHUB on devices that do not need in-field UpdateHub-based updates.
Remove the updatehub shell command from production shell configurations to reduce local trigger surface.
If CONFIG_USERSPACE is enabled, restrict UpdateHub syscall access to trusted supervisor threads only.

bash

# Kconfig example: disable UpdateHub in production builds
CONFIG_UPDATEHUB=n
CONFIG_UPDATEHUB_SHELL=n