CVE-2026-10663

{
  "id": "CVE-2026-10663",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-12T17:16:23.120",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() (subsys/usb/host/usbh_core.c) decides what to tear down solely from ctx->root, checking only that it is non-NULL.\n\nBecause UHC controller drivers (e.g. uhc_max3421e, uhc_mcux_common) synthesize UHC_EVT_DEV_REMOVED directly from physical bus line state with no debounce or state guard, an attacker with physical USB access (or a rogue device that bounces its connection) can deliver a second device-removed event after a root device disconnect. The handler then re-enters usbh_device_disconnect() with the dangling pointer, locking a mutex inside the freed object (use-after-free), removing the freed node from the device list, and calling k_mem_slab_free() on the already-freed block (double-free). If the slab block has been reissued to a newly attached device in between, this corrupts a live object.\n\nImpact is denial of service (crash) and memory corruption; the attack vector is physical/local. The flaw was introduced in v4.4.0 by the connect/disconnect refactor and is fixed by clearing ctx->root in usbh_device_disconnect() before freeing."
    },
    {
      "lang": "es",
      "value": "En la pila de host USB experimental de Zephyr (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) liberó el objeto slab raíz usb_device sin borrar el puntero en caché ctx  ->  root. El gestor de eliminación de bus dev_removed_handler() (subsys/usb/host/usbh_core.c) decide qué desmantelar únicamente a partir de ctx  ->  root, comprobando solo que no es NULL.\n\nDebido a que los controladores de host UHC (p. ej., uhc_max3421e, uhc_mcux_common) sintetizan UHC_EVT_DEV_REMOVED directamente del estado físico de la línea del bus sin antirrebote ni protección de estado, un atacante con acceso físico USB (o un dispositivo malicioso que rebota su conexión) puede entregar un segundo evento de eliminación de dispositivo después de una desconexión del dispositivo raíz. El gestor luego vuelve a entrar en usbh_device_disconnect() con el puntero colgante, bloqueando un mutex dentro del objeto liberado (uso después de liberación), eliminando el nodo liberado de la lista de dispositivos y llamando a k_mem_slab_free() en el bloque ya liberado (doble liberación). Si el bloque slab ha sido reasignado a un dispositivo recién conectado mientras tanto, esto corrompe un objeto en uso.\n\nEl impacto es denegación de servicio (bloqueo) y corrupción de memoria; el vector de ataque es físico/local. La falla se introdujo en la v4.4.0 por la refactorización de conexión/desconexión y se corrige borrando ctx  ->  root en usbh_device_disconnect() antes de liberar."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/usb/host/usbh_core.c",
            "subsys/usb/host/usbh_device.c"
          ],
          "versions": [
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T15:46:57.175579Z",
          "id": "CVE-2026-10663",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.4.0",
              "versionEndExcluding": "4.5.0",
              "matchCriteriaId": "FB84D027-409D-4419-BE61-FF6982D53EFB"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/4b87a8f161a44cb19505fa97db7cf72f64d49165",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-26q8-xjq3-f5p6",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}