CVE-2026-12051

{
  "id": "CVE-2026-12051",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T06:17:12.620",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/usb/device_next/class/usbd_dfu.c). The handler computes MIN(setup->wLength, buf->len) and passes buf->data to the image write callback without checking that the buf net_buf pointer is non-NULL.\n\nThe handler is reached over the USB control endpoint, driven by the USB host. For a DFU_DNLOAD (download) request with no Data OUT stage — notably the zero-length terminating download that the DFU protocol uses to end a firmware transfer — the USB core invokes the class handler with a NULL buffer. After the device has been advanced to the DFU_DNLOAD_IDLE state (by sending one valid download block and a GET_STATUS), a zero-length DFU_DNLOAD reaches handle_download() with buf == NULL, dereferencing it.\n\nThe result is a NULL+offset read that triggers a fatal CPU fault, i.e. a denial of service (device crash/reset). The attacker is whatever controls the USB host the device is attached to; DFU download support must be enabled with a registered image. There is no memory corruption or information disclosure — impact is limited to availability. The fix adds an explicit if (buf != NULL) guard so the callback receives a zero-length, NULL-data transfer instead of crashing."
    },
    {
      "lang": "es",
      "value": "La implementación de la clase USB DFU en la nueva (experimental) pila de dispositivos USB device_next de Zephyr contiene una desreferencia de puntero NULL en handle_download() (subsys/usb/device_next/class/usbd_dfu.c). El gestor calcula MIN(setup  ->  wLength, buf  ->  len) y pasa buf  ->  data a la función de devolución de llamada de escritura de imagen sin verificar que el puntero net_buf de buf no sea NULL.\n\nSe accede al gestor a través del punto final de control USB, impulsado por el host USB. Para una solicitud DFU_DNLOAD (descarga) sin una etapa de salida de datos (Data OUT) - en particular, la descarga de terminación de longitud cero que el protocolo DFU utiliza para finalizar una transferencia de firmware - el núcleo USB invoca al gestor de clase con un búfer NULL. Después de que el dispositivo ha avanzado al estado DFU_DNLOAD_IDLE (enviando un bloque de descarga válido y un GET_STATUS), una DFU_DNLOAD de longitud cero llega a handle_download() con buf == NULL, desreferenciándolo.\n\nEl resultado es una lectura NULL+offset que desencadena un fallo fatal de la CPU, es decir, una denegación de servicio (bloqueo/reinicio del dispositivo). El atacante es quien controla el host USB al que está conectado el dispositivo; el soporte de descarga DFU debe estar habilitado con una imagen registrada. No hay corrupción de memoria ni revelación de información - el impacto se limita a la disponibilidad. La solución añade una protección explícita if (buf != NULL) para que la función de devolución de llamada reciba una transferencia de longitud cero y datos NULL en lugar de bloquearse."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "subsys/usb/device_next/class/usbd_dfu.c"
          ],
          "versions": [
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T14:22:41.005101Z",
          "id": "CVE-2026-12051",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/552ca371257597b71490482d5cc597157ea60f12",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vhvq-q6rw-jvm4",
      "source": "[email protected]"
    }
  ]
}