CVE-2026-10647
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The USB CDC-NCM driver in Zephyr RTOS ignores the return value of usbd_ep_enqueue(). When enqueue fails (e.g., during USB bus suspend), the function blocks on a semaphore that never signals, causing a permanent deadlock of the TX thread and halting network transmission until reboot.
Risk Assessment
The risk is persistent loss of network connectivity over the NCM interface and potential stalling of other network interfaces sharing the same TX thread. A malicious USB host can intentionally suspend the bus to trigger the deadlock and disrupt device operation.
Recommendation
Immediately update Zephyr RTOS to a version containing the fix (post v4.4.0) that checks the return value of usbd_ep_enqueue() and frees the buffer before the blocking wait.
Other vulnerabilities in Zephyr RTOS
See all- CVE-2026-13480Low
A vulnerability in the LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in Zephyr RTOS (subsys/lorawan/services/frag_transport.c) lacks validation of remaining payload bytes before each access. An attacker with session keys can cause an out-of-bounds read (up to ~232 bytes) past the RxPayload buffer, copying adjacent static memory into decoder buffers and the FUOTA flash image.
- CVE-2026-13213Medium
A vulnerability in the Hearing Access Service (HAS) in Zephyr RTOS allows a remote (Bluetooth) crash of the HAS peripheral. The issue occurs when a previously bonded client reconnects during the startup window before the application registers the service, leading to an assertion or NULL pointer dereference.
- CVE-2026-12633High
Vulnerability in IPv6 neighbor-discovery code (subsys/net/ip/ipv6_nbr.c) in Zephyr RTOS. The handle_ra_6co() function does not bound the context_len field from the 6CO option in Router Advertisements, leading to a buffer overflow and out-of-bounds memset. An attacker on the same link can send a crafted packet causing a system crash.
- CVE-2026-9771High
A vulnerability in the flash_copy() system call in Zephyr RTOS (with CONFIG_USERSPACE enabled) allows an unprivileged thread to pass forged pointers to flash device structures. Lack of device object validation (src_dev, dst_dev) before dereferencing enables arbitrary code execution in supervisor mode, leading to privilege escalation outside the userspace sandbox.
- CVE-2026-12364High
The vulnerability in Zephyr RTOS concerns the system-call verifier z_vrfy_z_log_msg_static_create(), which did not validate arguments passed to the kernel function. This allows an unprivileged user thread to supply arbitrary pointers and lengths, leading to kernel memory reads and system crashes.
- CVE-2026-12363Medium
The LoRaWAN Fragmented Data Block Transport service (frag_transport.c) does not validate the fragment counter in a received DATA_FRAGMENT command before forwarding it to the decoder. A frag_counter of 0 causes an underflow (frag_counter - 1), leading to an out-of-bounds write (CWE-787) in the default Semtech/LoRaMAC-node decoder, corrupting decoder state and disrupting the firmware-update (FUOTA) session.
- CVE-2026-12233Medium
The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-filled static struct k_mutex credential_lock; and never called k_mutex_init() on it. A statically zero-filled k_mutex has an uninitialized wait queue (its dlist head/tail are NULL instead of the self-referential sentinels that k_mutex_init/K_MUTEX_DEFINE install). The uncontended lock path does not touch the wait queue, so the defect is latent and serialized use behaves correctly.
- CVE-2026-11812Low
The vulnerability in the UpdateHub subsystem (subsys/mgmt/updatehub/updatehub.c) is due to unsynchronized access to the shared ctx structure. Concurrent operations (background autohandler and user-triggered calls) can write past the fds[1] array, overwriting adjacent struct fields, leading to internal state corruption and denial of service in the firmware update path.
- CVE-2026-10849High
The hawkBit device management client in Zephyr RTOS has a heap-based out-of-bounds write vulnerability. The response buffer lacks space for a terminating null byte, causing a single null byte write past the allocated memory when the response length matches the buffer size.
- CVE-2026-10848High
In the OCPP 1.6 client in Zephyr RTOS, a vulnerability was found involving out-of-bounds buffer read during WAMP RPC frame parsing. The extract_string_field() function uses strncpy without guaranteed null-termination, leading to reads beyond the 128-byte buffer and potential out-of-bounds null write. The vulnerability can be remotely exploited by a malicious central server or an on-path attacker.
Original NVD description (English source)
The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send(). When the enqueue fails, the function still calls k_sem_take(&data->sync_sem, K_FOREVER), blocking on a completion semaphore that is only ever signaled from the bulk-IN transfer-completion callback. Because nothing was enqueued, that callback never fires and the calling thread — a shared network traffic-class TX thread — deadlocks permanently while holding the interface TX lock, halting transmission until reboot (and leaking the transmit buffer). The enqueue fails under conditions controlled by the attached USB host: usbd_ep_enqueue() returns -EPERM whenever the bus is suspended (a standard, persistent host operation), and the underlying udc_ep_enqueue() returns -EPERM/-ENODEV on disconnect, bus reset, or endpoint disable. The cdc_ncm_send() guard only checks the DATA_IFACE_ENABLED and IFACE_UP flags, not the suspended state, so a packet transmitted while the host holds the bus suspended reaches the failing enqueue and deadlocks the TX path. The realistic trigger is a bus suspend that occurs while the exported network interface is active and has traffic to send — host sleep, USB selective/auto-suspend, or hub power management — after which any device-originated packet deadlocks the path, recoverable only by reboot. The impact is a persistent loss of the virtual network connection between the host's NCM interface and the Zephyr device; because the deadlocked thread is a shared traffic-class TX thread, egress on other network interfaces can stall as well. There is no memory corruption or information disclosure. The defect was introduced with the CDC-NCM driver and shipped in releases through v4.4.0; it is fixed by checking the usbd_ep_enqueue() return value and freeing the buffer before the blocking wait.