Description
The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing on a ret > 0 flag, but ret was set to -1 immediately after the socket was created, so when zsock_setsockopt() (DTLS) or zsock_connect() subsequently failed the gate was false and cleanup_connection() was never called. The open descriptor in the global ctx.sock was then overwritten by the next attempt, permanently leaking it from the socket / net_context pool until reboot.

The failing setup path is reached every time the OTA client tries to contact the UpdateHub server and the connection cannot be established — driven automatically by the periodic autohandler() poll (and on demand via the updatehub_probe()/updatehub_update() API or the updatehub run shell command). The DTLS handshake/connect outcome is influenceable by a network or on-path attacker who drops, resets, or otherwise disrupts traffic to the server, and also fails naturally whenever the server is unreachable.

Each failed attempt permanently leaks one descriptor; once the shared socket pool is exhausted, networking degrades device-wide until the device is rebooted, a denial-of-service condition. Severity is low because the leak rate is bounded by the configured OTA poll interval (default once per 24 hours), the effect is gradual and recovered by reboot, and only builds with the UpdateHub client enabled are affected. There is no memory-corruption, information-disclosure, or authentication impact.
Published: 2026-08-10
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The UpdateHub over‑the‑air client leaks a CoAP/DTLS socket descriptor when the connection setup fails. The leak occurs on each failed attempt, and because the socket pool is overwritten only after a reboot, repeated failures accumulate until the global socket pool is exhausted. The gradual depletion of sockets leads to device‑wide networking degradation and a denial‑of‑service state without affecting memory corruption, information disclosure, or authentication. The weakness is a resource leak (CWE‑772).

Affected Systems

Zephyr Project Zephyr embedded operating system, specifically the UpdateHub OTA client component in subsys/mgmt/updatehub. The vulnerability is triggered when the OTA client is enabled and attempts to contact the UpdateHub server. No version range is explicitly specified, but the issue exists in code paths referenced by the public commit and advisory.

Risk and Exploitability

The CVSS score is 3.7, indicating low severity. EPSS is not available. The vulnerability is not listed in the CISA KEV catalog. An attacker can influence the DTLS handshake by dropping or resetting traffic to the UpdateHub server, thereby triggering connection‑failure paths. Because the leak rate is bounded by the OTA poll interval (default once per 24 hours), the impact is gradual and recoverable only by rebooting the device.

Generated by OpenCVE AI on August 11, 2026 at 00:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Zephyr release that includes the crash fix referenced by the advisory commit
  • If UpdateHub is not required, disable the OTA client to avoid the leak path
  • Monitor socket pool usage and perform a device reboot when unusual socket exhaustion is detected

Generated by OpenCVE AI on August 11, 2026 at 00:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 10 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Description The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-setup failure paths. The shared error: cleanup gated socket closing on a ret > 0 flag, but ret was set to -1 immediately after the socket was created, so when zsock_setsockopt() (DTLS) or zsock_connect() subsequently failed the gate was false and cleanup_connection() was never called. The open descriptor in the global ctx.sock was then overwritten by the next attempt, permanently leaking it from the socket / net_context pool until reboot. The failing setup path is reached every time the OTA client tries to contact the UpdateHub server and the connection cannot be established — driven automatically by the periodic autohandler() poll (and on demand via the updatehub_probe()/updatehub_update() API or the updatehub run shell command). The DTLS handshake/connect outcome is influenceable by a network or on-path attacker who drops, resets, or otherwise disrupts traffic to the server, and also fails naturally whenever the server is unreachable. Each failed attempt permanently leaks one descriptor; once the shared socket pool is exhausted, networking degrades device-wide until the device is rebooted, a denial-of-service condition. Severity is low because the leak rate is bounded by the configured OTA poll interval (default once per 24 hours), the effect is gradual and recovered by reboot, and only builds with the UpdateHub client enabled are affected. There is no memory-corruption, information-disclosure, or authentication impact.
Title Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS
Weaknesses CWE-772
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-10T22:55:17.389Z

Reserved: 2026-06-09T15:51:49.726Z

Link: CVE-2026-11811

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T02:30:17Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime