The UpdateHub management subsystem in Zephyr (subsys/mgmt/updatehub/updatehub.c) uses a single file-scope context structure (ctx) to manage update operations, including CoAP block context, payload buffer, status code, socket, and a poll-fd array of size one. Access to this ctx structure is not serialized, allowing two independent execution paths—the background autohandler and user-triggered operations—to concurrently mutate ctx. This concurrency leads to a race condition where prepare_fds() writes beyond the bounds of the poll-fd array, overlapping adjacent members of ctx. Such unsynchronized access can cause double-closing of socket descriptors or corruption of shared buffers, resulting in internal state corruption and denial of service of the firmware update path. Exploitation requires local actor capabilities and timing control; remote attackers cannot trigger the race. The fix involves serializing access with a mutex and adding bounds checking in prepare_fds().

The vulnerability causes corruption of the UpdateHub subsystem's internal state and denial of service of the firmware update mechanism. There is no impact on confidentiality or integrity, and no known path to code execution. Exploitation requires local access with low privileges and high attack complexity due to timing requirements. Remote exploitation is not feasible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor's fix serializes access to the shared context with a mutex and adds bounds checking to prevent out-of-bounds writes. Until a patch is applied, restrict local access to update operations to trusted users and consider disabling unprivileged userspace threads from invoking update operations if possible.