The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c) in Zephyr OS dereferences an endpoint buffer pointer without checking for NULL in its transfer-completion handlers. Specifically, udc_event_xfer_out_done() calls net_buf_add(buf, ep_request->actlen) immediately after buf = udc_buf_get(ep_cfg), but udc_buf_get() can return NULL if the endpoint FIFO is empty. A USB host can legally abort an in-flight EP0 control transfer by sending a new SETUP packet, which drains the FIFO and causes a stale transfer-completion event to be processed against an empty FIFO, resulting in a near-NULL pointer dereference and device crash. This vulnerability leads to denial of service and requires physical USB bus access. The defect was introduced in Zephyr v4.4.0 when the MAX32 UDC driver was added. The fix involves adding NULL-buffer checks that return early with an error code in the OUT-done and IN-done handlers.

The vulnerability allows a USB host connected to the device to cause a denial of service by crashing the device through a NULL pointer dereference in the USB device controller driver. There is no impact on confidentiality or integrity, only availability is affected. No authentication is required beyond physical USB connection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described adds NULL-buffer checks in the transfer-completion handlers to prevent NULL pointer dereference. Until an official patch or update is available, devices should consider restricting physical USB host access or monitoring for abnormal USB control transfer behavior to mitigate risk.