Executive brief
Zephyr is an open-source operating system designed for resource-constrained devices like IoT sensors and wearables. A flaw in its experimental USB host software allows an attacker with physical access to the device to cause a system crash or corrupt memory by rapidly connecting and disconnecting a rogue USB device. This could lead to a complete denial of service for the affected hardware.
Technical details
A vulnerability exists in Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK) within the usbh_device_disconnect() function. The function frees the root usb_device slab object but fails to clear the cached ctx->root pointer. Because certain UHC controller drivers (like uhc_max3421e) synthesize removal events directly from physical bus state without debouncing, a physically present attacker can trigger a second 'device-removed' event. This causes the handler to re-enter usbh_device_disconnect() using the dangling pointer, leading to a use-after-free (mutex lock on freed memory), double-free of the memory slab, and potential corruption of live objects if the slab was reallocated. The issue was introduced in v4.4.0 and is fixed in v4.5.0 by ensuring the pointer is cleared before the object is freed.
Affected products
- zephyrproject zephyr >= 4.4.0, < 4.5.0
Timeline
- 2026-07-12: advisory: GHSA-26q8-xjq3-f5p6 published
- 2026-07-12: disclosed: CVE-2026-10663 published
- 2026-07-12: patched: Fix merged into main branch