CVE-2026-10668

{
  "id": "CVE-2026-10668",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-12T17:16:24.787",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len in numaker_hsusbd_ep_trigger). Because the HSUSBD hardware cannot disarm a control Data IN already armed for a previous transfer, a USB host that cancels an in-flight control transfer (timeout) and then issues a new SETUP packet can drive the driver out of sync: stale data may be transmitted in the new transfer and the control endpoint can become permanently stuck NAK'ing every subsequent control transfer.\n\nA malicious or buggy host (physical/adjacent attacker driving the bus) can repeatedly cancel-and-re-SETUP to wedge the device's USB control endpoint, denying service to the device's USB function (the device stops enumerating/responding on the control pipe) until a USB reset or re-plug. The flaw is an availability-only denial of service; the FIFO copy loops (bounded by net_buf length and the hardware BUFFULL flag) and the net_buf lifecycle are independent of the arming desync, so there is no out-of-bounds access, use-after-free, or information leak.\n\nThe fix monitors the IN-token and new-SETUP events (k_event) and only arms control Data IN when an IN token is present and no new SETUP has arrived, cancelling the current transfer on a new SETUP. Affects boards using the Nuvoton NuMaker HSUSBD controller (CONFIG_UDC_NUMAKER with DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED); shipped in v4.4.0."
    },
    {
      "lang": "es",
      "value": "El controlador de dispositivo USB Nuvoton NuMaker HSUSBD (drivers/usb/udc/udc_numaker.c) armó la etapa de Datos de Control IN incondicionalmente (base  ->  CEPTXCNT = len en numaker_hsusbd_ep_trigger). Debido a que el hardware HSUSBD no puede desarmar una etapa de Datos de Control IN ya armada para una transferencia anterior, un host USB que cancela una transferencia de control en curso (tiempo de espera) y luego emite un nuevo paquete SETUP puede desincronizar el controlador: se pueden transmitir datos obsoletos en la nueva transferencia y el punto final de control puede quedarse permanentemente atascado enviando NAK a cada transferencia de control posterior.\n\nUn host malicioso o con errores (atacante físico/adyacente que controla el bus) puede cancelar y re-SETUP repetidamente para bloquear el punto final de control USB del dispositivo, denegación de servicio a la función USB del dispositivo (el dispositivo deja de enumerar/responder en el canal de control) hasta un reinicio USB o una reconexión. La falla es una denegación de servicio solo de disponibilidad; los bucles de copia FIFO (limitados por la longitud de net_buf y el indicador de hardware BUFFULL) y el ciclo de vida de net_buf son independientes de la desincronización del armado, por lo que no hay acceso fuera de límites, uso después de liberación, ni fuga de información.\n\nLa solución monitorea los eventos de token IN y nuevo SETUP (k_event) y solo arma la etapa de Datos de Control IN cuando un token IN está presente y no ha llegado un nuevo SETUP, cancelando la transferencia actual ante un nuevo SETUP. Afecta a las placas que utilizan el controlador Nuvoton NuMaker HSUSBD (CONFIG_UDC_NUMAKER con DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED); enviado en v4.4.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "drivers/usb/udc/Kconfig.numaker",
            "drivers/usb/udc/udc_numaker.c",
            "drivers/usb/udc/udc_numaker.h"
          ],
          "versions": [
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 2.4,
          "baseSeverity": "LOW",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 1.4
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T15:45:12.727668Z",
          "id": "CVE-2026-10668",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.4.0",
              "versionEndIncluding": "4.4.1",
              "matchCriteriaId": "BF44F4FC-9EF2-4562-ACEB-2BE5AE165E9C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-rm28-x84j-4qrx",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}