CVE-2026-10663: use-after-free in zephyrproject zephyr
In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() (subsys/usb/host/usbh_core.c) decides what to tear down solely from ctx->root, checking only that it is non-NULL. Because UHC controller drivers (e.g. uhc_max3421e, uhc_mcux_common) synthesize UHC_EVT_DEV_REMOVED directly from physical bus line state with no debounce or state guard, an attacker with physical USB access (or a rogue device that bounces its connection) can deliver a second device-removed event after a root device disconnect. The handler then re-enters usbh_device_disconnect() with the dangling pointer, locking a mutex inside the freed object (use-after-free), removing the freed node from the device list, and calling k_mem_slab_free() on the already-freed block (double-free). If the slab block has been reissued to a newly attached device in between, this corrupts a live object. Impact is denial of service (crash) and memory corruption; the attack vector is physical/local. The flaw was introduced in v4.4.0 by the connect/disconnect refactor and is fixed by clearing ctx->root in usbh_device_disconnect() before freeing.
AI Analysis
Technical Summary
In Zephyr's experimental USB host stack, the function usbh_device_disconnect() frees the root usb_device slab object but fails to clear the cached pointer ctx->root. The bus removal handler dev_removed_handler() relies on ctx->root to determine teardown actions. Due to the lack of debounce or state guards in UHC controller drivers, a second device-removed event can be triggered after the root device disconnect. This causes re-entry into usbh_device_disconnect() with a dangling pointer, resulting in a use-after-free and double-free condition. If the freed slab block is reallocated to a new device, this leads to memory corruption. The flaw was introduced in version 4.4.0 and fixed by clearing ctx->root before freeing the object.
Potential Impact
The vulnerability allows an attacker with physical USB access or a rogue USB device to trigger a use-after-free and double-free in the USB host stack, causing denial of service via system crash and potential memory corruption. There is no confidentiality impact, but integrity and availability are affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves clearing the ctx->root pointer in usbh_device_disconnect() before freeing the object to prevent use-after-free. Until an official fix is confirmed, avoid exposure to untrusted physical USB devices or disable the experimental USB host stack if possible.
CVE-2026-10663: use-after-free in zephyrproject zephyr
Description
In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() (subsys/usb/host/usbh_core.c) decides what to tear down solely from ctx->root, checking only that it is non-NULL. Because UHC controller drivers (e.g. uhc_max3421e, uhc_mcux_common) synthesize UHC_EVT_DEV_REMOVED directly from physical bus line state with no debounce or state guard, an attacker with physical USB access (or a rogue device that bounces its connection) can deliver a second device-removed event after a root device disconnect. The handler then re-enters usbh_device_disconnect() with the dangling pointer, locking a mutex inside the freed object (use-after-free), removing the freed node from the device list, and calling k_mem_slab_free() on the already-freed block (double-free). If the slab block has been reissued to a newly attached device in between, this corrupts a live object. Impact is denial of service (crash) and memory corruption; the attack vector is physical/local. The flaw was introduced in v4.4.0 by the connect/disconnect refactor and is fixed by clearing ctx->root in usbh_device_disconnect() before freeing.
CVSS v3.1
Score 6.1medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Zephyr's experimental USB host stack, the function usbh_device_disconnect() frees the root usb_device slab object but fails to clear the cached pointer ctx->root. The bus removal handler dev_removed_handler() relies on ctx->root to determine teardown actions. Due to the lack of debounce or state guards in UHC controller drivers, a second device-removed event can be triggered after the root device disconnect. This causes re-entry into usbh_device_disconnect() with a dangling pointer, resulting in a use-after-free and double-free condition. If the freed slab block is reallocated to a new device, this leads to memory corruption. The flaw was introduced in version 4.4.0 and fixed by clearing ctx->root before freeing the object.
Potential Impact
The vulnerability allows an attacker with physical USB access or a rogue USB device to trigger a use-after-free and double-free in the USB host stack, causing denial of service via system crash and potential memory corruption. There is no confidentiality impact, but integrity and availability are affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves clearing the ctx->root pointer in usbh_device_disconnect() before freeing the object to prevent use-after-free. Until an official fix is confirmed, avoid exposure to untrusted physical USB devices or disable the experimental USB host stack if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:25:23.699Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a54991068715ace436e94d4
Added to database: 07/13/2026, 07:51:44 UTC
Last enriched: 07/13/2026, 07:52:46 UTC
Last updated: 07/13/2026, 19:47:35 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.