TL;DR: The UpdateHub OTA client in Zephyr RTOS leaks a socket file descriptor every time its CoAP/DTLS connection setup fails. The cleanup path checked a flag that was already set to -1, so the socket never closed. Each leaked descriptor permanently consumes a slot in the shared net_context pool. Once the pool drains, networking degrades across the entire device until reboot. Fixed in Zephyr 4.4.2.

What to do

Update Zephyr RTOS to 4.4.2, which contains the fix (commit 29e34765). If you cannot update immediately, disabling CONFIG_UPDATEHUB removes the vulnerable code path entirely. Devices already exhibiting degraded networking should be rebooted to restore the socket pool.

What happened

Zephyr RTOS is a Linux Foundation real-time operating system for embedded and IoT devices. The UpdateHub subsystem provides over-the-air firmware updates using CoAP and DTLS. The vulnerability is in start_coap_client() inside subsys/mgmt/updatehub/updatehub.c.

The bug is a resource-leak pattern that repeat-fails into a denial of service. When the OTA client tries to contact the UpdateHub server, start_coap_client() creates a socket and stores its descriptor in ctx.sock. If zsock_setsockopt() (for DTLS) or zsock_connect() subsequently fails, the function should clean up by closing the socket via cleanup_connection(). The cleanup call is gated on a flag ret > 0, but ret was set to -1 immediately after the socket was created. The gate evaluates to false. cleanup_connection() never runs. The descriptor stays open in ctx.sock until the next attempt overwrites it, at which point the old descriptor is permanently leaked from the socket and net_context pool.

The failing path is not a corner case. The periodic autohandler() poll drives it automatically on every OTA check cycle (default interval: once per 24 hours). It also fires on demand through updatehub_probe(), updatehub_update(), or the updatehub run shell command. The connection fails whenever the UpdateHub server is unreachable, which happens during network outages, server maintenance, or when an on-path attacker drops or resets traffic to the server.

Each failed attempt leaks exactly one descriptor. The shared socket pool in Zephyr is finite. Once exhausted, all networking on the device degrades until a reboot recycles the pool.

Who is affected

Zephyr RTOS builds with CONFIG_UPDATEHUB enabled, running versions prior to 4.4.2. The vulnerability is classified as CWE-772 (Improper Release of Resource). NVD has not yet assigned a CVSS score at time of writing.

The attack surface extends beyond local triggers. A network or on-path attacker who can disrupt DTLS traffic to the UpdateHub server can force repeated connection failures and accelerate descriptor exhaustion. The leak rate is bounded by the configured OTA poll interval, which defaults to once per 24 hours, making the DoS gradual rather than instantaneous.

Why it matters

Embedded devices run with constrained resource pools. A socket leak that compounds over time, even at one per day, will eventually exhaust networking capacity on devices expected to run for months or years without intervention. Industrial sensors, smart meters, and medical devices deployed in the field rarely get rebooted proactively. When the UpdateHub client itself is the source of the leak, the device loses both update capability and general network connectivity, creating a scenario where the fix cannot reach the device through its normal OTA path.

References

• NVD: CVE-2026-11811
• GitHub Security Advisory GHSA-q3mh-4wj7-mq7f
• Fix commit: 29e3476501a65c0bcd469abd275749d324008ce2