An flaw in the STM32 USB device controller driver embedded in Zephyr RTOS causes the interrupt handler to enter an endless loop when processing USB events. This unchecked loop, classified as CWE‑835, prevents the kernel from servicing other tasks, effectively freezing the system and denying service to legitimate USB operations.

The vulnerability resides in the Zephyr RTOS STM32 USB device driver (drivers/usb/device/usb_dc_stm32.c). Every Zephyr build that includes this driver may be impacted, as no specific version was identified in the advisory.

The CVSS score of 6.1 indicates moderate severity and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could trigger the infinite loop by interacting with the USB subsystem, for example by sending malformed USB packets or by connecting a compromised peripheral. If the system permits USB access from untrusted sources, the denial of service could affect any user relying on USB functionality.