CVE-2026-11812

Name of the Vulnerable Software and Affected Versions UpdateHub (affected versions not specified)

Description The UpdateHub management subsystem contains a race condition in the subsys/mgmt/updatehub/updatehub.c file. The subsystem uses a single file-scope ctx structure to manage update operations, including a one-element poll-fd array fds[1]. Because access to ctx is not serialized, the prepare fds() function can write to ctx.fds[ctx.nfds] and increment ctx.nfds without a bounds check. This occurs when a background autohandler and a user-triggered operation (via shell commands, API calls, or userspace threads) mutate the ctx concurrently. If a second flow enters prepare fds() while ctx.nfds is already 1, an out-of-bounds write occurs, overlapping the ctx.sock and ctx.nfds members. This unsynchronized sharing can also lead to double-closing socket descriptors or buffer corruption, resulting in the corruption of the internal state and a denial of service of the firmware-update path. Exploitation requires a local actor to win a timing race against the background handler.

Recommendations As a temporary mitigation, restrict the ability of unprivileged userspace threads or local actors to invoke update operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.