The Zephyr Nuvoton NuMaker HSUSBD USB device-controller driver (udc_numaker.c) arms the control Data IN stage unconditionally, which the hardware cannot disarm if a previous transfer is still armed. A USB host that cancels an ongoing control transfer and then sends a new SETUP packet can cause the driver to become out of sync, transmitting stale data and causing the control endpoint to permanently NAK further control transfers. This effectively wedges the USB control endpoint, denying service to the device's USB function until a USB reset or re-plug occurs. The flaw is limited to availability impact and does not cause out-of-bounds access, use-after-free, or information leaks. The fix involves monitoring IN-token and new-SETUP events to arm the control Data IN stage only when appropriate, cancelling current transfers on new SETUP packets. This vulnerability affects Zephyr versions 4.4.0 through before 4.5.0 on boards with CONFIG_UDC_NUMAKER and DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED.

The vulnerability causes a denial of service by permanently disabling the USB control endpoint on affected devices after a specific sequence of USB host actions (canceling an in-flight control transfer followed by a new SETUP packet). This results in the device no longer enumerating or responding on the control pipe, effectively stopping USB communication until a physical USB reset or re-plug. There is no impact on confidentiality or integrity, and no memory corruption issues are present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves updating the driver to monitor IN-token and new-SETUP events and only arm the control Data IN stage when appropriate, cancelling current transfers on new SETUP packets. Until a fix is applied, affected devices may require manual USB reset or re-plug to recover from the denial-of-service condition.