Description
The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/usb/device_next/class/usbd_dfu.c). The handler computes MIN(setup->wLength, buf->len) and passes buf->data to the image write callback without checking that the buf net_buf pointer is non-NULL.

The handler is reached over the USB control endpoint, driven by the USB host. For a DFU_DNLOAD (download) request with no Data OUT stage — notably the zero-length terminating download that the DFU protocol uses to end a firmware transfer — the USB core invokes the class handler with a NULL buffer. After the device has been advanced to the DFU_DNLOAD_IDLE state (by sending one valid download block and a GET_STATUS), a zero-length DFU_DNLOAD reaches handle_download() with buf == NULL, dereferencing it.

The result is a NULL+offset read that triggers a fatal CPU fault, i.e. a denial of service (device crash/reset). The attacker is whatever controls the USB host the device is attached to; DFU download support must be enabled with a registered image. There is no memory corruption or information disclosure — impact is limited to availability. The fix adds an explicit if (buf != NULL) guard so the callback receives a zero-length, NULL-data transfer instead of crashing.
Published: 2026-08-11
Score: 4.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A NULL pointer dereference occurs in the USB DFU class implementation when handling a download request that contains no data. The handler passes a NULL buffer pointer to the image write callback, causing a fatal CPU fault and a device reset. The flaw does not result in memory corruption or data leakage; its sole effect is the loss of availability.

Affected Systems

The issue affects Zephyr RTOS devices that use the experimental device_next USB device stack with the DFU class enabled. No specific firmware versions are listed, so any build that includes the unpatched DFU implementation could be vulnerable.

Risk and Exploitability

With a CVSS score of 4.6 the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog. It can be triggered by any USB host that initiates a DFU_DNLOAD request without a data stage, such as the zero‑length terminating download used by the DFU protocol. Once triggered, the device will crash, potentially disrupting operations. Because the flaw requires the attacker to have control over the USB host, the risk is limited to those environments where the device is connected to an untrusted host.

Generated by OpenCVE AI on August 11, 2026 at 06:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Zephyr to a version that includes the fix from commit 552ca371, which adds a guard to ensure the buffer pointer is not NULL before invoking the callback.
  • If upgrading is not immediately possible, modify the DFU handler to check for a NULL buffer and handle it gracefully by treating it as a zero‑length transfer. This aligns with the suggested CWE‑476 remediation for null dereference errors.
  • Disable DFU download support on devices that do not require firmware updates, or enforce that a valid image is registered before enabling DFU functionality.

Generated by OpenCVE AI on August 11, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Tue, 11 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Description The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/usb/device_next/class/usbd_dfu.c). The handler computes MIN(setup->wLength, buf->len) and passes buf->data to the image write callback without checking that the buf net_buf pointer is non-NULL. The handler is reached over the USB control endpoint, driven by the USB host. For a DFU_DNLOAD (download) request with no Data OUT stage — notably the zero-length terminating download that the DFU protocol uses to end a firmware transfer — the USB core invokes the class handler with a NULL buffer. After the device has been advanced to the DFU_DNLOAD_IDLE state (by sending one valid download block and a GET_STATUS), a zero-length DFU_DNLOAD reaches handle_download() with buf == NULL, dereferencing it. The result is a NULL+offset read that triggers a fatal CPU fault, i.e. a denial of service (device crash/reset). The attacker is whatever controls the USB host the device is attached to; DFU download support must be enabled with a registered image. There is no memory corruption or information disclosure — impact is limited to availability. The fix adds an explicit if (buf != NULL) guard so the callback receives a zero-length, NULL-data transfer instead of crashing.
Title NULL pointer dereference in USB DFU device_next download handler (handle_download)
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 4.6, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-31T23:13:23.141Z

Reserved: 2026-06-11T22:20:54.897Z

Link: CVE-2026-12051

cve-icon Vulnrichment

Updated: 2026-08-11T14:22:46.064Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-11T06:17:12.620

Modified: 2026-09-01T00:16:42.720

Link: CVE-2026-12051

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T07:30:03Z

Weaknesses