Executive brief
A vulnerability exists in the MAX32xxx USB driver within the Zephyr operating system, which is used to manage USB communications on embedded devices. By sending specific, standard USB commands, a physically connected USB host can cause the device to crash. This results in a denial-of-service, potentially disrupting the operations of hardware relying on this driver.
Technical details
A NULL pointer dereference exists in the MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c) within the OUT and IN transfer-completion handlers. The vulnerability is caused by a race condition where `udc_event_xfer_out_done()` calls `net_buf_add()` on a buffer returned by `udc_buf_get()` without checking if the buffer is NULL. Because `udc_buf_get()` returns NULL when the endpoint FIFO is empty, a USB host can trigger this by aborting an in-flight EP0 control transfer with a new SETUP packet, which drains the FIFO before the asynchronous driver thread processes the completion event. This results in a kernel fault and denial of service. The issue is fixed in Zephyr v4.5.0 by adding NULL-buffer checks in the affected handlers.
Affected products
- Zephyr Project Zephyr RTOS 4.4.0
Timeline
- 2026-07-05: advisory
- 2026-07-05: disclosed