Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-16147— it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ITE IT82xx2 USB 设备控制器驱动（ ）在处理非控制端点上的多数据包 OUT 传输时存在缺陷。 在 中，活动传输缓冲区通过 获取（该函数仅查看而不将缓冲区从队列中出队）。当收到一个满包大小的数据包，但缓冲区仍有剩余空间（即传输尚未完成）时，修复前的代码存在以下问题： 1. 通过 重新武装端点，继续向同一个缓冲区写入数据； 2. 同时通过 将同一个仍在被写入的缓冲区交给上层 USB 设备栈。 由于 会将缓冲区的所有权转移给 USB 设备栈（ 将 追加到 ，随后类处理器处理并调用 释放缓冲区），驱动程序继续

CVSS 6.8 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-16147

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption
Source: CVE Program / CVE List V5
Vulnerability Description
The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_out() the active transfer buffer is obtained with udc_buf_peek() (which does not dequeue it); when a full max-packet-size packet arrives but the buffer still has tailroom (the transfer is not yet complete), the pre-fix code both re-arms the endpoint to keep filling that same buf via work_handler_xfer_continue() and simultaneously hands the same, still-being-filled buffer to the upper stack with udc_submit_ep_event(). Because udc_submit_ep_event() transfers ownership of the buffer to the USB device stack (usbd_event_carrier() appends &buf->node to uds_ctx->ep_events, after which the class handler processes and net_buf_unref()s it), the driver continues to DMA subsequent host-controlled OUT packets into a buffer the upper stack may already have freed and recycled — a use-after-free write. In addition, since the buffer was never dequeued, the completing packet runs udc_buf_get() on the same object and submits it a second time, appending &buf->node to the event slist twice (singly-linked-list corruption) and causing a double net_buf_unref(). The IT82xx2 is a USB peripheral controller, so the untrusted USB host controls OUT-transfer packetization and can force this path against any non-control OUT endpoint whose queued buffer exceeds one packet — an ordinary bulk/interrupt pattern. The driver and USB device stack run in kernel context above the external host, giving the host a device-side kernel heap-corruption primitive: a reliable denial of service and, because the written bytes are attacker-controlled, plausible corruption of adjacent net_buf pool memory. The vector is physical (USB attach). The fix defers submission until the buffer is completely filled and lets xfer_work_handler() drive continuation, so each OUT buffer is submitted to the upper stack exactly once.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.0.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-16147

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-16147

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-16147 (1)

Vendor Advisories for CVE-2026-16147 (1)

Same Patch Batch · zephyrproject · 2026-09-14 · 5 CVEs total

CVE-2026-15893 6.5 MEDIUM Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement cause
CVE-2026-15924 5.9 MEDIUM Use-after-free / double-free from unsynchronized concurrent access to the TLS client sessi
CVE-2026-15923 4.6 MEDIUM Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_
CVE-2026-16148 4.6 MEDIUM Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy d

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-416

V. Comments for CVE-2026-16147

No comments yet

Leave a comment