Executive brief
Zephyr's experimental USB host stack contains a memory management flaw where a configuration descriptor buffer can be freed twice when a USB device provides malformed or inconsistent descriptor data during enumeration. An attacker controlling a malicious USB device can trigger this double-free to crash the system with a denial of service on systems with heap hardening enabled, or corrupt heap memory on systems without protections, potentially leading to memory disclosure or code execution.
Technical details
A per-device configuration descriptor buffer allocated from usb_device_heap is freed multiple times due to a dangling pointer: it is released on three failure paths in usbh_device_set_configuration() but the pointer is not nullified, and then freed again in usbh_device_free() which only checks if the pointer is non-NULL. The double-free is triggered entirely by an attached USB peripheral answering configuration descriptor requests with well-formed headers followed by inconsistent or malformed data. On CONFIG_SYS_HEAP_HARDENING_BASIC (default), this results in a kernel panic; without hardening, heap metadata corruption allows overlapping allocations.
Affected products
- Zephyr Project Zephyr RTOS 4.1.0, 4.2.x, 4.3.x, 4.4.x
Timeline
- 2026-09-21: disclosed