CVE-2026-16147— it82xx2 USB 控制器释放后使用及事件列表损坏
一分钟漏洞结论
影响对象
zephyrproject zephyr
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
ITE IT82xx2 USB 设备控制器驱动（ ）在处理非控制端点上的多数据包 OUT 传输时存在缺陷。 在 中，活动传输缓冲区通过 获取（该函数仅查看而不将缓冲区从队列中出队）。当收到一个满包大小的数据包，但缓冲区仍有剩余空间（即传输尚未完成）时，修复前的代码存在以下问题： 1. 通过 重新武装端点，继续向同一个缓冲区写入数据； 2. 同时通过 将同一个仍在被写入的缓冲区交给上层 USB 设备栈。 由于 会将缓冲区的所有权转移给 USB 设备栈（ 将 追加到 ，随后类处理器处理并调用 释放缓冲区），驱动程序继续
可能的 ATT&CK 技术 1 AI
T1190 · Exploit Public-Facing Application
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-16147 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption
来源: CVE Program / CVE List V5
Vulnerability Description
The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_out() the active transfer buffer is obtained with udc_buf_peek() (which does not dequeue it); when a full max-packet-size packet arrives but the buffer still has tailroom (the transfer is not yet complete), the pre-fix code both re-arms the endpoint to keep filling that same buf via work_handler_xfer_continue() and simultaneously hands the same, still-being-filled buffer to the upper stack with udc_submit_ep_event().
Because udc_submit_ep_event() transfers ownership of the buffer to the USB device stack (usbd_event_carrier() appends &buf->node to uds_ctx->ep_events, after which the class handler processes and net_buf_unref()s it), the driver continues to DMA subsequent host-controlled OUT packets into a buffer the upper stack may already have freed and recycled — a use-after-free write. In addition, since the buffer was never dequeued, the completing packet runs udc_buf_get() on the same object and submits it a second time, appending &buf->node to the event slist twice (singly-linked-list corruption) and causing a double net_buf_unref().
The IT82xx2 is a USB peripheral controller, so the untrusted USB host controls OUT-transfer packetization and can force this path against any non-control OUT endpoint whose queued buffer exceeds one packet — an ordinary bulk/interrupt pattern. The driver and USB device stack run in kernel context above the external host, giving the host a device-side kernel heap-corruption primitive: a reliable denial of service and, because the written bytes are attacker-controlled, plausible corruption of adjacent net_buf pool memory. The vector is physical (USB attach). The fix defers submission until the buffer is completely filled and lets xfer_work_handler() drive continuation, so each OUT buffer is submitted to the upper stack exactly once.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
释放后使用
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| zephyrproject | zephyr | 4.0.0 ~ 4.4.2 | - |
|
二、漏洞 CVE-2026-16147 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-16147 的情报信息
请登录查看更多情报信息。
CVE-2026-16147 补丁与修复 (1)
CVE-2026-16147 厂商安全公告 (1)
同批安全公告 · zephyrproject · 2026-09-14 · 共 5 条
| CVE-2026-15893 | 6.5 MEDIUM | Zephyr IPv6邻居发现协议路由通告触发拒绝服务漏洞 |
| CVE-2026-15924 | 5.9 MEDIUM | Zephyr 套接字TLS会话缓存并发访问UAF漏洞 |
| CVE-2026-15923 | 4.6 MEDIUM | Zephyr 文件系统 SDIO 拒绝服务漏洞 |
| CVE-2026-16148 | 4.6 MEDIUM | it82xx2驱动致内核恐慌 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-16147
暂无评论