CVE-2026-90587: Zephyr USB host stack null pointer dereference in device enumeration

CVE-2026-90587 · Severity: medium · CVSS 4.6 · Published 2026-11-09

Zephyr's USB host stack fails to properly validate USB devices that report zero configurations during enumeration. An attacker can trigger a denial-of-service condition or out-of-bounds memory reads by attaching a malicious USB device, bypassing any authentication or user interaction requirements. On systems with null pointer protection, this causes a fatal exception; on others, it enables reading sensitive memory near address zero.

Technologies: Zephyr OS. Vendors: Zephyr.

Quick answers

Is CVE-2026-90587 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-90587 being exploited in the wild.
How severe is CVE-2026-90587?
Medium severity, with a CVSS score of 4.6, published 9 November 2026.
Which products and versions are affected?
Zephyr OS versions with CONFIG_USB_HOST_STACK enabled.
Is there a fix for CVE-2026-90587?
Yes: fixed in <UNKNOWN>. Until then: Disable CONFIG_USB_HOST_STACK if USB host functionality is not required, or restrict physical USB port access to trusted devices only. Ensure CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled if available on the target platform to convert out-of-bounds reads into catchable exceptions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-90587 attacked?
It is attacked with physical access, in an operating system.
Am I affected by CVE-2026-90587?
Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: <UNKNOWN>

Disable CONFIG_USB_HOST_STACK if USB host functionality is not required, or restrict physical USB port access to trusted devices only. Ensure CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled if available on the target platform to convert out-of-bounds reads into catchable exceptions.

Technical details

The vulnerability exists in usbh_device_init() in subsys/usb/host/usbh_device.c, which rejects devices with bNumConfigurations == 0 but fails to set an error code before returning, leaving err = 0 (success). This skips configuration descriptor allocation in udev->cfg_desc, leaving it NULL. Subsequent descriptor parsing passes the NULL pointer to validation functions that only check caller-supplied size, not pointer validity, leading to null dereference or out-of-bounds reads. The trigger requires only physical USB attachment with no authentication; impact is denial of service via exception or information disclosure via bounded out-of-bounds read on platforms where address zero is readable.

Affected products

  • Zephyr Zephyr OS versions with CONFIG_USB_HOST_STACK enabled

Timeline

  • 2026-11-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.