CVE-2026-10668— Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver
Quick assessment
Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 Zephyr Project Zephyr存在资源管理错误漏洞，该漏洞源于Nuvoton NuMaker HSUSBD USB设备控制器驱动无条件的控制数据IN阶段武装，导致设备USB控制端点可能出现拒绝服务。以下版本受到影响：4.4.0版本至4.5.0之前版本。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| zephyrproject | zephyr | 4.4.0< 4.5.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10668
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver
Source: CVE Program / CVE List V5
Vulnerability Description
The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len in numaker_hsusbd_ep_trigger). Because the HSUSBD hardware cannot disarm a control Data IN already armed for a previous transfer, a USB host that cancels an in-flight control transfer (timeout) and then issues a new SETUP packet can drive the driver out of sync: stale data may be transmitted in the new transfer and the control endpoint can become permanently stuck NAK'ing every subsequent control transfer.
A malicious or buggy host (physical/adjacent attacker driving the bus) can repeatedly cancel-and-re-SETUP to wedge the device's USB control endpoint, denying service to the device's USB function (the device stops enumerating/responding on the control pipe) until a USB reset or re-plug. The flaw is an availability-only denial of service; the FIFO copy loops (bounded by net_buf length and the hardware BUFFULL flag) and the net_buf lifecycle are independent of the arming desync, so there is no out-of-bounds access, use-after-free, or information leak.
The fix monitors the IN-token and new-SETUP events (k_event) and only arms control Data IN when an IN token is present and no new SETUP has arrived, cancelling the current transfer on a new SETUP. Affects boards using the Nuvoton NuMaker HSUSBD controller (CONFIG_UDC_NUMAKER with DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED); shipped in v4.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Zephyr Project Zephyr 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
zephyrproject zephyr是zephyrproject组织开源的一款实时操作系统内核。 Zephyr Project Zephyr存在资源管理错误漏洞，该漏洞源于Nuvoton NuMaker HSUSBD USB设备控制器驱动无条件的控制数据IN阶段武装，导致设备USB控制端点可能出现拒绝服务。以下版本受到影响：4.4.0版本至4.5.0之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zephyrproject | zephyr | 4.4.0 ~ 4.5.0 | - |
|
II. Public POCs for CVE-2026-10668
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10668
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-10668 (1)
Vendor Advisories for CVE-2026-10668 (1)
Same Patch Batch · zephyrproject · 2026-07-12 · 6 CVEs total
| CVE-2026-10666 | 8.1 HIGH | Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/ne |
| CVE-2026-10667 | 7.8 HIGH | SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable |
| CVE-2026-10665 | 7.4 HIGH | Heap buffer overflow on WireGuard receive path via unbounded incoming packet length |
| CVE-2026-10663 | 6.1 MEDIUM | Use-after-free / double-free of the root USB device in the experimental USB host stack |
| CVE-2026-10664 | 5.0 MEDIUM | Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow cou |
IV. Related Vulnerabilities
Same product: zephyr
-
CVE-2026-17053
SMBus callback-removal syscalls accept an unvalidated user p -
CVE-2026-18747
Integer underflow of net_buf length in the MCUmgr serial (SM -
CVE-2026-18746
NULL pointer dereference in Zephyr LwM2M client when the CoA -
CVE-2026-18417
Wild pointer dereference in Zephyr BSD sockets when a TCP li -
CVE-2026-18416
Out-of-bounds read in CoAP well-known-core Uri-Query href ma
Same vendor: zephyrproject
-
CVE-2026-17053
SMBus callback-removal syscalls accept an unvalidated user p -
CVE-2026-18747
Integer underflow of net_buf length in the MCUmgr serial (SM -
CVE-2026-18746
NULL pointer dereference in Zephyr LwM2M client when the CoA -
CVE-2026-18417
Wild pointer dereference in Zephyr BSD sockets when a TCP li -
CVE-2026-18416
Out-of-bounds read in CoAP well-known-core Uri-Query href ma
Same weakness: CWE-400
-
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SV -
CVE-2026-104844
PostCSS: Quadratic complexity in flat selector parsing allow -
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-103760
Mooncake transfer engine through 0.3.13.post1 Denial of Serv -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool
V. Comments for CVE-2026-10668
No comments yet