TI-2026-09165 Aliases CVE-2026-10663

Use-after-free / double-free of the root USB device in the experimental USB host stack

LOW 27CWE-416Published 2026-07-12 · Updated 2026-11-04

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() (subsys/usb/host/usbh_core.c) decides what to tear down solely from ctx->root, checking only that it is non-NULL. Because UHC controller drivers (e.g. uhc_max3421e, uhc_mcux_common) synthesize UHC_EVT_DEV_REMOVED directly from physical bus line state with no debounce or state guard, an attacker with physical USB access (or a rogue device that bounces its connection) can deliver a second device-removed event after a root device disconnect. The handler then re-enters usbh_device_disconnect() with the dangling pointer, locking a mutex inside the freed object (use-after-free), removing the freed node from the device list, and calling k_mem_slab_free() on the already-freed block (double-free). If the slab block has been reissued to a newly attached device in between, this corrupts a live object. Impact is denial of service (crash) and memory corruption; the attack vector is physical/local. The flaw was introduced in v4.4.0 by the connect/disconnect refactor and is fixed by clearing ctx->root in usbh_device_disconnect() before freeing.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00236 14th percentileScored 2026-11-07

Fix Fixed zephyr (zephyrproject): 4.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zephyrproject	zephyr	4.4.0 to before 4.4.2	4.4.2	Patch available	CNA

zephyr Vendorzephyrproject Affected 4.4.0 to before 4.4.2 Fixed in 4.4.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:zephyrproject:zephyr::::::::	4.4.0 to before 4.5.0	Vulnerable	zephyrproject

cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* Versions 4.4.0 to before 4.5.0 Vulnerable ·zephyrproject

Remediation

Fix · CNA zephyr (zephyrproject) Fixed in 4.4.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-07-12
zephyrproject zephyr 4.4.2
3 records Highest priority Priority HIGH 1 HIGH, 2 LOW
Other records, highest priority first
- TI-2026-09167 Heap buffer overflow on WireGuard receive path via unbounded incoming packet lengthPriority HIGH 66
- TI-2026-09170 Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driverPriority LOW 21
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-10663
2026-10-16 Fix available: [email protected] · CNA

References

Patch 2

TI-2026-04422 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key CVSS 3.1CRITICAL 9.8
TI-2026-01361 dns: memory‑safety issue in the DNS name parser CVSS 3.1CRITICAL 9.8
TI-2026-09174 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) CVSS 3.1CRITICAL 9.1
TI-2026-09168 Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c` CVSS 3.1CRITICAL 9.8
TI-2024-09625 net: lib: http_server: Buffer Under-read CVSS 3.1HIGH 8.6
TI-2021-02863 Usb bluetooth device ACL read cb buffer overflow CVSS 3.1CRITICAL 9.6

See all 196 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences