Executive brief
A vulnerability in the Nuvoton NuMaker USB driver for Zephyr OS can allow a connected USB host to disable the device's USB functionality. By sending specific malformed or timed-out sequences, an attacker with physical access can cause the device to stop responding to all USB commands. This results in a denial of service that typically requires a physical unplug or device reset to recover.
Technical details
The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) unconditionally arms the control Data IN stage. Because the underlying hardware cannot disarm a previously armed Data IN transfer, a host that cancels an in-flight transfer and immediately issues a new SETUP packet causes a synchronization failure. This results in the control endpoint permanently NAK'ing subsequent transfers, leading to a denial of service. The vulnerability is limited to availability; memory safety is maintained as FIFO copy loops remain bounded by buffer lengths. The fix introduces event monitoring to ensure Data IN is only armed when an IN token is present and no new SETUP has arrived.
Affected products
- Zephyr Project Zephyr OS >= 4.4.0, < 4.5.0
Timeline
- 2026-07-12: disclosed
- 2026-07-12: advisory
- 2026-05-13: patched: Fix merged into main branch