Description
In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() (subsys/usb/host/usbh_core.c) decides what to tear down solely from ctx->root, checking only that it is non-NULL.

Because UHC controller drivers (e.g. uhc_max3421e, uhc_mcux_common) synthesize UHC_EVT_DEV_REMOVED directly from physical bus line state with no debounce or state guard, an attacker with physical USB access (or a rogue device that bounces its connection) can deliver a second device-removed event after a root device disconnect. The handler then re-enters usbh_device_disconnect() with the dangling pointer, locking a mutex inside the freed object (use-after-free), removing the freed node from the device list, and calling k_mem_slab_free() on the already-freed block (double-free). If the slab block has been reissued to a newly attached device in between, this corrupts a live object.

Impact is denial of service (crash) and memory corruption; the attack vector is physical/local. The flaw was introduced in v4.4.0 by the connect/disconnect refactor and is fixed by clearing ctx->root in usbh_device_disconnect() before freeing.
Published: 2026-07-12
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free followed by a double‑free vulnerability exists in Zephyr’s experimental USB host stack (CONFIG_USB_HOST_STACK). When a root USB device disconnect event is processed, the root usb_device object is freed but the cached pointer is not cleared. A subsequent device‑removed event can re‑enter the disconnect routine with a dangling pointer, lock a freed mutex, remove a freed node from the device list, and then free the already‑freed slab block. This results in a crash and can corrupt live objects if memory has been re‑issued to a newly attached device. The weakness is categorized as CWE‑416: Use‑After‑Free. The impact is a denial of service.

Affected Systems

The flaw affects the Zephyr RTOS experimental USB host stack when the CONFIG_USB_HOST_STACK configuration is enabled and controller drivers such as uhc_max3421e or uhc_mcux_common are in use. The problem was introduced with the connect/disconnect refactor in Zephyr v4.4.0 and applies to all builds from that point onward until a fix is applied. Any release that includes the affected kernel code and does not clear the ctx->root pointer before freeing is vulnerable.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of < 1% shows a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack requires physical or local access to the target device’s USB bus or a rogue USB device that can immediately toggle the connection state. The exploitation can terminate the application or corrupt memory, but it does not enable remote code execution. Given the very low exploitation likelihood and physical access requirement, the overall risk is moderate to low for systems with restricted physical access.

Generated by OpenCVE AI on August 1, 2026 at 11:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Zephyr source tree to the commit that clears ctx->root before freeing the root device
  • Rebuild and flash the firmware with the updated kernel
  • If updating is not immediately possible, disable CONFIG_USB_HOST_STACK in your build configuration
  • As a temporary measure, add application‑level debouncing or state guard logic in the USB removal handler to prevent repeated removal events from re‑entering the disconnect routine

Generated by OpenCVE AI on August 1, 2026 at 11:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 12 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Sun, 12 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Description In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() (subsys/usb/host/usbh_core.c) decides what to tear down solely from ctx->root, checking only that it is non-NULL. Because UHC controller drivers (e.g. uhc_max3421e, uhc_mcux_common) synthesize UHC_EVT_DEV_REMOVED directly from physical bus line state with no debounce or state guard, an attacker with physical USB access (or a rogue device that bounces its connection) can deliver a second device-removed event after a root device disconnect. The handler then re-enters usbh_device_disconnect() with the dangling pointer, locking a mutex inside the freed object (use-after-free), removing the freed node from the device list, and calling k_mem_slab_free() on the already-freed block (double-free). If the slab block has been reissued to a newly attached device in between, this corrupts a live object. Impact is denial of service (crash) and memory corruption; the attack vector is physical/local. The flaw was introduced in v4.4.0 by the connect/disconnect refactor and is fixed by clearing ctx->root in usbh_device_disconnect() before freeing.
Title Use-after-free / double-free of the root USB device in the experimental USB host stack
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-14T18:38:44.214Z

Reserved: 2026-06-02T15:25:23.699Z

Link: CVE-2026-10663

cve-icon Vulnrichment

Updated: 2026-07-13T15:47:00.708Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T11:15:03Z

Weaknesses