# CVE-2026-90587: Zephyr USB host stack null pointer dereference in device enumeration

Source: https://junglewise.ai/threats/cve-2026-90587-usbh-device-init-in-subsys-usb-host-usbh-device-c-rejects-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-90587 · Severity: medium · CVSS 4.6 · Published 2026-11-09

Zephyr's USB host stack fails to properly validate USB devices that report zero configurations during enumeration. An attacker can trigger a denial-of-service condition or out-of-bounds memory reads by attaching a malicious USB device, bypassing any authentication or user interaction requirements. On systems with null pointer protection, this causes a fatal exception; on others, it enables reading sensitive memory near address zero.

Technologies: [Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-zephyr-os). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-90587 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90587 being exploited in the wild.

**How severe is CVE-2026-90587?** Medium severity, with a CVSS score of 4.6, published 9 November 2026.

**Which products and versions are affected?** Zephyr OS versions with CONFIG_USB_HOST_STACK enabled.

**Is there a fix for CVE-2026-90587?** Yes: fixed in <UNKNOWN>. Until then: Disable CONFIG_USB_HOST_STACK if USB host functionality is not required, or restrict physical USB port access to trusted devices only. Ensure CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled if available on the target platform to convert out-of-bounds reads into catchable exceptions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90587 attacked?** It is attacked with physical access, in an operating system.

**Am I affected by CVE-2026-90587?** Check whether you run Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

Disable CONFIG_USB_HOST_STACK if USB host functionality is not required, or restrict physical USB port access to trusted devices only. Ensure CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled if available on the target platform to convert out-of-bounds reads into catchable exceptions.

## Technical details

The vulnerability exists in usbh_device_init() in subsys/usb/host/usbh_device.c, which rejects devices with bNumConfigurations == 0 but fails to set an error code before returning, leaving err = 0 (success). This skips configuration descriptor allocation in udev->cfg_desc, leaving it NULL. Subsequent descriptor parsing passes the NULL pointer to validation functions that only check caller-supplied size, not pointer validity, leading to null dereference or out-of-bounds reads. The trigger requires only physical USB attachment with no authentication; impact is denial of service via exception or information disclosure via bounded out-of-bounds read on platforms where address zero is readable.

## Affected products

- Zephyr Zephyr OS versions with CONFIG_USB_HOST_STACK enabled

## Timeline

- 2026-11-09: disclosed

## Related threats

- [Zephyr charger driver kernel privilege escalation via user-mode syscall verification](https://junglewise.ai/threats/cve-2026-91007-the-user-mode-syscall-verifiers-for-the-charger-driver-api-in)
- [Zephyr kernel thread stack memory leak via k_thread_abort](https://junglewise.ai/threats/cve-2026-90589-when-config-thread-stack-mem-mapped-is-enabled-each-thread-stack)
- [Zephyr I2S user-mode syscall verifier unvalidated pointer dereference](https://junglewise.ai/threats/cve-2026-87039-the-user-mode-syscall-verifier-z-vrfy-i2s-configure-in-drivers)
- [Zephyr AVRCP Target vendor response buffer leak on disconnection](https://junglewise.ai/threats/cve-2026-85033-the-avrcp-target-role-in-subsys-bluetooth-host-classic-avrcp-c)
- [Zephyr Bluetooth Classic HFP AG stack crash on RFCOMM connection failure](https://junglewise.ai/threats/cve-2026-82389-in-the-bluetooth-classic-hands-free-profile-audio-gateway-role)