The vulnerability in Zephyr's Nuvoton NuMaker HSUSBD USB device-controller driver arises because the control Data IN stage is armed unconditionally without checking for new SETUP packets. Since the hardware cannot disarm an already armed control Data IN, a USB host that cancels an ongoing control transfer and immediately sends a new SETUP packet can cause the driver to become desynchronized. This desynchronization results in stale data being transmitted and the control endpoint permanently NAK'ing further control transfers, effectively denying service to the device's USB function until a USB reset or re-plug occurs. The flaw is availability-only and does not cause memory corruption or information disclosure. The fix involves monitoring IN-token and new-SETUP events to arm the control Data IN stage only when appropriate, cancelling current transfers on new SETUP packets. The vulnerability affects Zephyr version 4.4.0 on boards with CONFIG_UDC_NUMAKER and DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED.

The vulnerability causes a denial of service by making the USB control endpoint permanently unresponsive after a specific sequence of USB host actions (canceling an in-flight control transfer followed by a new SETUP packet). This results in the device's USB function stopping enumeration and response on the control pipe until a USB reset or re-plug. There is no impact on confidentiality or integrity, and no memory corruption or information leakage occurs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that monitors IN-token and new-SETUP events to prevent the control endpoint from becoming stuck. Until an official patch or update is available, affected devices may require manual USB reset or re-plug to recover from the denial of service condition. No other mitigations are specified.