Double free of the USB host configuration descriptor when device enumeration fails

Summary

CVE	CVE-2026-17050
State	PUBLISHED
Assigner	zephyr
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-09-21 17:17:34 UTC
Updated	2026-09-22 19:41:24 UTC
Description	The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-length GET_DESCRIPTOR(CONFIGURATION) read, a mismatch between the short and full descriptor reads, and a rejected descriptor in parse_configuration_descriptor() — the buffer was released with k_heap_free() but the pointer was left dangling. The cleanup in usbh_device_free() is guarded only by if (udev->cfg_desc != NULL), so it frees the same block a second time. The path is driven entirely by the attached peripheral: usbh_device_connect() calls usbh_device_init(), which ends in usbh_device_set_configuration(), and on failure usbh_device_connect() calls usbh_device_free(). On v4.4.x this happens during the same enumeration, with no unplug required; on v4.1.0–v4.3.x the second free instead arrives via dev_removed_handler()/dev_connected_handler() in subsys/usb/host/usbh_core.c, so it requires a removal or duplicate-connect event after the failed enumeration — a sequence the attached device fully controls. A malicious or malformed USB device only has to answer the first 9-byte configuration-descriptor request with a well-formed header and then fail any of the three checks, for example by returning a full descriptor whose interface count disagrees with bNumInterfaces, or by answering the second read with different bytes. The result is a double free on usb_device_heap. On builds where lib/heap hardening is active (the current default CONFIG_SYS_HEAP_HARDENING_BASIC), sys_heap_free() detects the already-free chunk and calls k_panic(), giving a deterministic, peripheral-triggered denial of service of the USB host. On builds without that detection — earlier releases, or CONFIG_SYS_HEAP_HARDENING_NONE — the second free manipulates a chunk already on the free list, corrupting the heap's free list so that later allocations can return overlapping or invalid blocks. Exploitation beyond denial of service is bounded by the fact that usb_device_heap is a small dedicated heap (CONFIG_USBH_USB_DEVICE_HEAP, default 1024 bytes) whose only client is this descriptor buffer, and by CONFIG_USB_HOST_STACK being marked experimental and disabled by default. The fix sets udev->cfg_desc = NULL after every k_heap_free(), making the cleanup guard sound.

Risk And Classification

Primary CVSS: v3.1 5.7 MEDIUM from [email protected]

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

EPSS: 0.001570000 probability, percentile 0.052510000 (date 2026-09-23)

Problem Types: CWE-415 | CWE-415 use-after-free

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	5.7	MEDIUM	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H`
3.1	CNA	CVSS	5.7	MEDIUM	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H`

CVSS v3.1 Breakdown

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Zephyrproject	Zephyr	affected 4.1.0 4.4.2 semver	Not specified

References

Reference	Source	Link	Tags
github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-r7xw-9jhg-...	[email protected]	github.com
github.com/zephyrproject-rtos/zephyr/commit/d46a8c1f8fb65e1f80b44bd651a6...	[email protected]	github.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.