CVE-2026-10653

CVE-2026-10653 concerns the Zephyr net_buf library (lib/net_buf/buf.c) where two non-atomic reference counters (buf->ref and per-data-block ref_count) are updated with plain C operators. In true concurrency, multiple unref() calls without locking can observe the same prior count and both decid...