The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c) in Zephyr OS dereferences an endpoint buffer without checking for NULL in its OUT and IN transfer-completion handlers. Specifically, udc_event_xfer_out_done() calls net_buf_add(buf, ep_request->actlen) immediately after buf = udc_buf_get(ep_cfg), but udc_buf_get() can return NULL if the endpoint FIFO is empty. Because transfer-completion events are queued from interrupt context and processed asynchronously, a USB host can drain the FIFO by sending a new SETUP packet, causing a stale event to be processed with a NULL buffer pointer. This results in a near-NULL pointer dereference that crashes the device. The vulnerability was introduced in Zephyr v4.4.0 with the addition of the MAX32 UDC driver. The fix involves adding NULL-buffer checks that return early with an error code in the OUT-done and IN-done handlers.

An attacker with physical USB bus access (the USB host) can cause the affected device to crash by sending a new SETUP packet to abort an in-flight control transfer. This leads to a denial of service condition due to a NULL pointer dereference in the USB device controller driver. There is no impact on confidentiality or integrity, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described involves adding NULL-buffer checks in the transfer-completion handlers to prevent dereferencing NULL pointers. Until a patch is available, avoid connecting the device to untrusted USB hosts or physically restrict USB host access to prevent exploitation.