USB Host Stack Vulnerability in Zephyr Project Affects Multiple Versions

CVE-2026-17050

What is CVE-2026-17050?

The USB host stack in the Zephyr Project contains a vulnerability that allows malicious USB devices to trigger a double free condition on the usb_device_heap. The flaw arises when an attacker provides crafted responses during the configuration descriptor read process, leading to potential heap corruption. Affected devices that manipulate the read responses can exploit this flaw to cause denial of service conditions. In builds with heap hardening features enabled, the exploit results in a deterministic panic, while in other configurations, it can corrupt the heap's free list, resulting in invalid memory allocations. The vulnerability is mitigated in recent patches by ensuring proper nullification of pointers after memory deallocation.

References