Zephyr's network buffer library used non‑atomic operations to manipulate the per‑header reference count and the per‑data‑block reference counter. When two contexts concurrently called the unreferencing routine, each could view the same prior value and both think they were the final owner, leading to a double free or duplicate return to the buffer pool. The result is corruption of heap metadata, a use‑after‑free with heap‑hardening poison, or a corrupted free list that can hand the same buffer to multiple owners. Such memory corruption is a critical flaw that can enable an attacker to execute arbitrary code or crash the system.

All Zephyr releases up through version 4.4.0 are affected. The issue is present in the Zephyr project’s network buffer library across all modules that use net_buf, including networking, Bluetooth, zbus, and USBIP.

The CVSS score of 6.4 indicates a moderate severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires true concurrency, such as SMP or preemption between the non‑atomic load and store when another context releases the same buffer. An external attacker has at most indirect influence over the race window, so while the flaw is serious, successful exploitation would depend on a highly orchestrated scenario rather than a simple remote attack.