CVE-2026-10647

{
  "id": "CVE-2026-10647",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-29T22:16:42.940",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send(). When the enqueue fails, the function still calls k_sem_take(&data->sync_sem, K_FOREVER), blocking on a completion semaphore that is only ever signaled from the bulk-IN transfer-completion callback. Because nothing was enqueued, that callback never fires and the calling thread — a shared network traffic-class TX thread — deadlocks permanently while holding the interface TX lock, halting transmission until reboot (and leaking the transmit buffer).\n\nThe enqueue fails under conditions controlled by the attached USB host: usbd_ep_enqueue() returns -EPERM whenever the bus is suspended (a standard, persistent host operation), and the underlying udc_ep_enqueue() returns -EPERM/-ENODEV on disconnect, bus reset, or endpoint disable. The cdc_ncm_send() guard only checks the DATA_IFACE_ENABLED and IFACE_UP flags, not the suspended state, so a packet transmitted while the host holds the bus suspended reaches the failing enqueue and deadlocks the TX path.\n\nThe realistic trigger is a bus suspend that occurs while the exported network interface is active and has traffic to send — host sleep, USB selective/auto-suspend, or hub power management — after which any device-originated packet deadlocks the path, recoverable only by reboot. The impact is a persistent loss of the virtual network connection between the host's NCM interface and the Zephyr device; because the deadlocked thread is a shared traffic-class TX thread, egress on other network interfaces can stall as well. There is no memory corruption or information disclosure.\n\nThe defect was introduced with the CDC-NCM driver and shipped in releases through v4.4.0; it is fixed by checking the usbd_ep_enqueue() return value and freeing the buffer before the blocking wait."
    },
    {
      "lang": "es",
      "value": "La clase de dispositivo USB CDC-NCM (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignora el valor de retorno de usbd_ep_enqueue() en su callback de transmisión ethernet cdc_ncm_send(). Cuando la puesta en cola falla, la función sigue llamando a k_sem_take(&data-sync_sem, K_FOREVER), bloqueándose en un semáforo de finalización que solo se señaliza desde el callback de finalización de transferencia bulk-IN. Debido a que nada fue puesto en cola, ese callback nunca se activa y el hilo llamador - un hilo TX compartido de clase de tráfico de red - se interbloquea permanentemente mientras mantiene el bloqueo TX de la interfaz, deteniendo la transmisión hasta el reinicio (y fugando el búfer de transmisión).\n\nLa puesta en cola falla bajo condiciones controladas por el host USB conectado: usbd_ep_enqueue() devuelve -EPERM siempre que el bus está suspendido (una operación de host estándar y persistente), y la udc_ep_enqueue() subyacente devuelve -EPERM/-ENODEV en caso de desconexión, reinicio del bus o deshabilitación del endpoint. La guarda de cdc_ncm_send() solo verifica las banderas DATA_IFACE_ENABLED e IFACE_UP, no el estado suspendido, por lo que un paquete transmitido mientras el host mantiene el bus suspendido alcanza la puesta en cola fallida e interbloquea la ruta TX.\n\nEl disparador realista es una suspensión del bus que ocurre mientras la interfaz de red exportada está activa y tiene tráfico para enviar - suspensión del host, suspensión selectiva/automática de USB o gestión de energía del hub - después de lo cual cualquier paquete originado por el dispositivo interbloquea la ruta, recuperable solo mediante un reinicio. El impacto es una pérdida persistente de la conexión de red virtual entre la interfaz NCM del host y el dispositivo Zephyr; debido a que el hilo interbloqueado es un hilo TX compartido de clase de tráfico, la salida en otras interfaces de red también puede detenerse. No hay corrupción de memoria ni revelación de información.\n\nEl defecto fue introducido con el controlador CDC-NCM y se envió en versiones hasta la v4.4.0; se corrige verificando el valor de retorno de usbd_ep_enqueue() y liberando el búfer antes de la espera bloqueante."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/usb/device_next/class/usbd_cdc_ncm.c"
          ],
          "versions": [
            {
              "version": "4.0.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-30T13:33:24.759453Z",
          "id": "CVE-2026-10647",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-833"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.1.0",
              "versionEndExcluding": "4.5.0",
              "matchCriteriaId": "126A079E-DBC1-4B1D-AE33-D21D14520336"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/255bccc1badd1aa06c6e5ddf5b40de8463b33f02",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xcf7-r86m-5q9f",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}