Improper Input Validation in Zephyr USB Host Stack

CVE-2026-90587

What is CVE-2026-90587?

The Zephyr USB Host Stack contains an improper input validation vulnerability where devices with a descriptor setting bNumConfigurations to 0 are incorrectly processed. This leads to the function usbh_device_init() logging an error without appropriately setting the return code, allowing for a zero return that misleads the system into treating it as a successful enumeration. When a USB device reporting bNumConfigurations = 0 is connected, it can result in a crash or behavior inconsistencies due to NULL pointer dereferences. Although there are no identified attacker-controlled writes, out-of-bounds reads may occur, impacting the system's availability. This issue can be triggered through the physical connection of the device, requiring no authentication.

References