The UpdateHub subsystem in Zephyr RTOS uses a shared context structure that holds CoAP block information and socket state. Because this context is accessed concurrently by a background handler and by user‑initiated update operations, the code fails to serialize the access and performs an out‑of‑bounds write when the array of poll file descriptors is incremented without bounds checking. The write corrupts adjacent fields inside the same structure, which can lead to a corrupted update state and ultimately a denial of service of the firmware‑update path. The damage is limited to the update subsystem; there is no evidence that the overwrite reaches memory outside the context or that it can be used for code execution or data exfiltration. The weakness is a race condition (CWE‑362).

Affected vendor: Zephyr Project. Product: Zephyr RTOS (UpdateHub management subsystem). No specific version range is supplied in the advisory; the vulnerability exists in the source code path subsys/mgmt/updatehub/updatehub.c prior to the commit referenced in the advisory.

The CVSS score is 2.5, indicating a low severity rating. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation appears limited. Because the flaw requires a local actor who can invoke an update operation and which case is subject to a timing race against a background system workqueue, it cannot be triggered remotely. The risk is therefore confined to devices with an exposed UpdateHub interface or where user space update operations are allowed, and only to those who can run privileged (or unprivileged userspace) threads that can win the race window. Mitigation via a mutex and bounds check removes the race condition entirely.