Denial of Service Vulnerability in Zephyr's Device USB Stack

CVE-2026-12051

What is CVE-2026-12051?

A vulnerability exists in the USB DFU class implementation of Zephyr's device_next USB stack, where a NULL pointer dereference occurs in the handle_download() function. This issue can be triggered by a zero-length DFU_DNLOAD request when the buffer is NULL, leading to a fatal CPU fault and causing a denial of service condition. Attackers with control over the USB host can exploit this scenario, but no memory corruption or information disclosure occurs. A fix has been implemented to check for a non-NULL buffer before proceeding with the callback, preventing device crashes during firmware transfers.

References