Quick answers
- Is CVE-2026-10663 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-10663 being exploited in the wild.
- How severe is CVE-2026-10663?
- Medium severity, with a CVSS score of 6.1, published 12 July 2026.
- Which products and versions are affected?
- Zephyr Project Zephyr >= 4.4.0, < 4.5.0.
- Is there a fix for CVE-2026-10663?
- A patch was published on 2026-07-12: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-10663 attacked?
- It is attacked with physical access, in an operating system.
- Am I affected by CVE-2026-10663?
- Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK) within the usbh_device_disconnect() function. The function frees the root usb_device slab object but fails to clear the cached ctx->root pointer. Because certain UHC controller drivers (like uhc_max3421e) synthesize removal events directly from physical bus state without debouncing, a physically present attacker can trigger a second 'device-removed' event. This causes the handler to re-enter usbh_device_disconnect() using the dangling pointer, leading to a use-after-free (mutex lock on freed memory), double-free of the memory slab, and potential corruption of live objects if the slab was reallocated. The issue was introduced in v4.4.0 and is fixed in v4.5.0 by ensuring the pointer is cleared before the object is freed.
Affected products
- zephyrproject zephyr >= 4.4.0, < 4.5.0
Timeline
- 2026-07-12: advisory: GHSA-26q8-xjq3-f5p6 published
- 2026-07-12: disclosed: CVE-2026-10663 published
- 2026-07-12: patched: Fix merged into main branch