The Nuvoton NuMaker HSUSBD USB device‑controller driver unconditionally arms the control Data IN stage. Because the hardware cannot disarm a previously armed control Data IN, a USB host that cancels an in‑flight control transfer and then issues a new SETUP packet can desynchronize the driver. The result is that stale data may be transmitted and the control endpoint permanently stops responding (continues to NAK) until a USB reset or re‑plug, causing a denial of service. No data corruption, memory errors, or information leakage occurs; the flaw impacts only availability. The weakness is a CWE‑400 Resource Exhaustion flaw.

Vulnerable code resides in the Zephyr project, particularly drivers/usb/udc/udc_numaker.c, for boards that use the Nuvoton NuMaker HSUSBD controller. The affected configuration is CONFIG_UDC_NUMAKER enabled with DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED. The bug exists in versions prior to the 4.4.0 release, which ships a patch that monitors IN‑tokens and SETUP events to prevent the desynchronization.

The CVSS score of 2.4 classifies the vulnerability as low severity, and the EPSS score indicates a very low probability of exploitation at this time. The flaw is listed as not being in CISA’s KEV catalog. Exploitation requires a USB host capable of sending multiple cancel and SETUP requests, typically Once triggered, the device remains stuck until a reset, so attackers can deny service but cannot gain code execution or data access. The low CVSS and EPSS scores suggest that the risk to most deployments is modest, albeit the impact can be significant if the device provides critical USB functionality.