CVE-2026-10656
Full vulnerability record from the local CVENow database.
Description
The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c, compatible adi_max32_usbhs) dereferenced an endpoint buffer in its OUT and IN transfer-completion handlers without checking it for NULL. udc_event_xfer_out_done() called net_buf_add(buf, ep_request->actlen) immediately after buf = udc_buf_get(ep_cfg), where udc_buf_get() returns NULL when the endpoint FIFO is empty. A transfer-completion event is queued from interrupt context and processed asynchronously by the driver thread; between queuing and processing, the endpoint FIFO can be drained by host-controlled control flow — in particular udc_setup_received() drains the EP0 OUT/IN FIFOs whenever a new SETUP packet arrives, and dequeue/disable/purge paths drain it likewise. A USB host that aborts an in-flight EP0 control transfer with a new SETUP packet (legal USB behavior) can therefore cause a stale XFER_OUT_DONE event to be processed against an empty FIFO, producing net_buf_add(NULL, ...), a near-NULL pointer dereference that faults and crashes the device. No authentication is required; the attacker is the USB host the device is connected to (physical bus access). Impact is denial of service (device crash). The defect was introduced when the MAX32 UDC driver was added and shipped in Zephyr v4.4.0. The fix adds NULL-buffer checks that return early with UDC_EVT_ERROR/-ENOBUFS in both the OUT-done and IN-done handlers.
View original CVE JSON
{
"id": "CVE-2026-10656",
"sourceIdentifier": "[email protected]",
"published": "2026-07-05T23:16:52.730",
"lastModified": "2026-10-25T15:10:00.147",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c, compatible adi_max32_usbhs) dereferenced an endpoint buffer in its OUT and IN transfer-completion handlers without checking it for NULL. udc_event_xfer_out_done() called net_buf_add(buf, ep_request->actlen) immediately after buf = udc_buf_get(ep_cfg), where udc_buf_get() returns NULL when the endpoint FIFO is empty.\n\nA transfer-completion event is queued from interrupt context and processed asynchronously by the driver thread; between queuing and processing, the endpoint FIFO can be drained by host-controlled control flow — in particular udc_setup_received() drains the EP0 OUT/IN FIFOs whenever a new SETUP packet arrives, and dequeue/disable/purge paths drain it likewise.\n\nA USB host that aborts an in-flight EP0 control transfer with a new SETUP packet (legal USB behavior) can therefore cause a stale XFER_OUT_DONE event to be processed against an empty FIFO, producing net_buf_add(NULL, ...), a near-NULL pointer dereference that faults and crashes the device. No authentication is required; the attacker is the USB host the device is connected to (physical bus access). Impact is denial of service (device crash).\n\nThe defect was introduced when the MAX32 UDC driver was added and shipped in Zephyr v4.4.0. The fix adds NULL-buffer checks that return early with UDC_EVT_ERROR/-ENOBUFS in both the OUT-done and IN-done handlers."
},
{
"lang": "es",
"value": "El controlador de dispositivo USB MAX32xxx (drivers/usb/udc/udc_max32.c, compatible adi_max32_usbhs) desreferenció un búfer de punto final en sus manejadores de finalización de transferencia OUT e IN sin verificar si era NULL. udc_event_xfer_out_done() llamó a net_buf_add(buf, ep_request -> actlen) inmediatamente después de buf = udc_buf_get(ep_cfg), donde udc_buf_get() devuelve NULL cuando la FIFO del punto final está vacía. Un evento de finalización de transferencia se encola desde el contexto de interrupción y es procesado asincrónicamente por el hilo del controlador; entre el encolamiento y el procesamiento, la FIFO del punto final puede ser vaciada por el flujo de control controlado por el host - en particular, udc_setup_received() vacía las FIFOs OUT/IN de EP0 cada vez que llega un nuevo paquete SETUP, y las rutas de desencolamiento/deshabilitación/purga la vacían de manera similar. Un host USB que aborta una transferencia de control EP0 en curso con un nuevo paquete SETUP (comportamiento USB legal) puede, por lo tanto, hacer que un evento XFER_OUT_DONE obsoleto sea procesado contra una FIFO vacía, produciendo net_buf_add(NULL, ...), una desreferencia de puntero casi-NULL que causa un fallo y bloquea el dispositivo. No se requiere autenticación; el atacante es el host USB al que está conectado el dispositivo (acceso físico al bus). El impacto es denegación de servicio (bloqueo del dispositivo). El defecto fue introducido cuando el controlador UDC MAX32 fue añadido y distribuido en Zephyr v4.4.0. La solución añade verificaciones de búfer NULL que retornan anticipadamente con UDC_EVT_ERROR/-ENOBUFS tanto en los manejadores de finalización OUT como en los de finalización IN."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "zephyrproject",
"product": "zephyr",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
"packageName": "zephyr",
"programFiles": [
"drivers/usb/udc/udc_max32.c"
],
"versions": [
{
"version": "4.2.0",
"lessThan": "4.4.1",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-06T18:52:25.573518Z",
"id": "CVE-2026-10656",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.2.0",
"versionEndIncluding": "4.4.0",
"matchCriteriaId": "2333543A-2859-4C85-906B-FF6DBE95A355"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/zephyrproject-rtos/zephyr/commit/a0d8f786559355fb3b38e34799e1ae491ba9545c",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-58p9-6mjq-rf2m",
"source": "[email protected]",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
]
}
]
}