CVE-2026-17050: use-after-free in zephyrproject zephyr
The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-length GET_DESCRIPTOR(CONFIGURATION) read, a mismatch between the short and full descriptor reads, and a rejected descriptor in parse_configuration_descriptor() — the buffer was released with k_heap_free() but the pointer was left dangling. The cleanup in usbh_device_free() is guarded only by if (udev->cfg_desc != NULL), so it frees the same block a second time. The path is driven entirely by the attached peripheral: usbh_device_connect() calls usbh_device_init(), which ends in usbh_device_set_configuration(), and on failure usbh_device_connect() calls usbh_device_free(). On v4.4.x this happens during the same enumeration, with no unplug required; on v4.1.0–v4.3.x the second free instead arrives via dev_removed_handler()/dev_connected_handler() in subsys/usb/host/usbh_core.c, so it requires a removal or duplicate-connect event after the failed enumeration — a sequence the attached device fully controls. A malicious or malformed USB device only has to answer the first 9-byte configuration-descriptor request with a well-formed header and then fail any of the three checks, for example by returning a full descriptor whose interface count disagrees with bNumInterfaces, or by answering the second read with different bytes. The result is a double free on usb_device_heap. On builds where lib/heap hardening is active (the current default CONFIG_SYS_HEAP_HARDENING_BASIC), sys_heap_free() detects the already-free chunk and calls k_panic(), giving a deterministic, peripheral-triggered denial of service of the USB host. On builds without that detection — earlier releases, or CONFIG_SYS_HEAP_HARDENING_NONE — the second free manipulates a chunk already on the free list, corrupting the heap's free list so that later allocations can return overlapping or invalid blocks. Exploitation beyond denial of service is bounded by the fact that usb_device_heap is a small dedicated heap (CONFIG_USBH_USB_DEVICE_HEAP, default 1024 bytes) whose only client is this descriptor buffer, and by CONFIG_USB_HOST_STACK being marked experimental and disabled by default. The fix sets udev->cfg_desc = NULL after every k_heap_free(), making the cleanup guard sound.
AI Analysis
Technical Summary
The vulnerability exists in the Zephyr project's experimental USB host stack where the per-device configuration descriptor buffer (udev->cfg_desc) is allocated from a dedicated heap. On three specific failure paths during configuration descriptor retrieval and parsing, the buffer is freed but the pointer is not cleared, leading to a double free when cleanup occurs. This double free can cause a kernel panic if heap hardening is enabled, resulting in a deterministic denial of service triggered by a connected USB device. Without heap hardening, heap corruption may occur, potentially causing invalid or overlapping memory allocations. The vulnerability affects Zephyr versions from 4.1.0 up to but not including 4.4.2. The fix involves setting the pointer to NULL immediately after freeing the buffer to prevent double free.
Potential Impact
The primary impact is a deterministic denial of service on the USB host stack caused by a double free and subsequent kernel panic when heap hardening is enabled. Without heap hardening, heap corruption may occur, which could destabilize the system or cause unpredictable behavior. Confidentiality and integrity impacts are rated low, but availability impact is high due to the denial of service. Exploitation requires a malicious or malformed USB device during enumeration. The vulnerability does not require user interaction or privileges but requires physical or logical USB device connection.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The known fix sets the configuration descriptor pointer to NULL after freeing it to prevent double free. Until an official patch is applied, avoid connecting untrusted USB devices to systems running affected Zephyr versions. Enabling heap hardening (CONFIG_SYS_HEAP_HARDENING_BASIC) can help detect and mitigate exploitation by triggering a kernel panic on double free, though this results in denial of service rather than silent corruption.
CVE-2026-17050: use-after-free in zephyrproject zephyr
Description
The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-length GET_DESCRIPTOR(CONFIGURATION) read, a mismatch between the short and full descriptor reads, and a rejected descriptor in parse_configuration_descriptor() — the buffer was released with k_heap_free() but the pointer was left dangling. The cleanup in usbh_device_free() is guarded only by if (udev->cfg_desc != NULL), so it frees the same block a second time. The path is driven entirely by the attached peripheral: usbh_device_connect() calls usbh_device_init(), which ends in usbh_device_set_configuration(), and on failure usbh_device_connect() calls usbh_device_free(). On v4.4.x this happens during the same enumeration, with no unplug required; on v4.1.0–v4.3.x the second free instead arrives via dev_removed_handler()/dev_connected_handler() in subsys/usb/host/usbh_core.c, so it requires a removal or duplicate-connect event after the failed enumeration — a sequence the attached device fully controls. A malicious or malformed USB device only has to answer the first 9-byte configuration-descriptor request with a well-formed header and then fail any of the three checks, for example by returning a full descriptor whose interface count disagrees with bNumInterfaces, or by answering the second read with different bytes. The result is a double free on usb_device_heap. On builds where lib/heap hardening is active (the current default CONFIG_SYS_HEAP_HARDENING_BASIC), sys_heap_free() detects the already-free chunk and calls k_panic(), giving a deterministic, peripheral-triggered denial of service of the USB host. On builds without that detection — earlier releases, or CONFIG_SYS_HEAP_HARDENING_NONE — the second free manipulates a chunk already on the free list, corrupting the heap's free list so that later allocations can return overlapping or invalid blocks. Exploitation beyond denial of service is bounded by the fact that usb_device_heap is a small dedicated heap (CONFIG_USBH_USB_DEVICE_HEAP, default 1024 bytes) whose only client is this descriptor buffer, and by CONFIG_USB_HOST_STACK being marked experimental and disabled by default. The fix sets udev->cfg_desc = NULL after every k_heap_free(), making the cleanup guard sound.
CVSS v3.1
Score 5.7medium
Affected software
zephyrproject
zephyr
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the Zephyr project's experimental USB host stack where the per-device configuration descriptor buffer (udev->cfg_desc) is allocated from a dedicated heap. On three specific failure paths during configuration descriptor retrieval and parsing, the buffer is freed but the pointer is not cleared, leading to a double free when cleanup occurs. This double free can cause a kernel panic if heap hardening is enabled, resulting in a deterministic denial of service triggered by a connected USB device. Without heap hardening, heap corruption may occur, potentially causing invalid or overlapping memory allocations. The vulnerability affects Zephyr versions from 4.1.0 up to but not including 4.4.2. The fix involves setting the pointer to NULL immediately after freeing the buffer to prevent double free.
Potential Impact
The primary impact is a deterministic denial of service on the USB host stack caused by a double free and subsequent kernel panic when heap hardening is enabled. Without heap hardening, heap corruption may occur, which could destabilize the system or cause unpredictable behavior. Confidentiality and integrity impacts are rated low, but availability impact is high due to the denial of service. Exploitation requires a malicious or malformed USB device during enumeration. The vulnerability does not require user interaction or privileges but requires physical or logical USB device connection.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The known fix sets the configuration descriptor pointer to NULL after freeing it to prevent double free. Until an official patch is applied, avoid connecting untrusted USB devices to systems running affected Zephyr versions. Enabling heap hardening (CONFIG_SYS_HEAP_HARDENING_BASIC) can help detect and mitigate exploitation by triggering a kernel panic on double free, though this results in denial of service rather than silent corruption.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-07-24T13:31:03.256Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab17f3e55bf5e2cf554e7c7
Added to database: 09/21/2026, 19:02:22 UTC
Last enriched: 09/21/2026, 19:16:52 UTC
Last updated: 09/22/2026, 00:40:11 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.