Zephyr RTOS CVE-2026-10647

Three conditions must hold simultaneously: (1) the Zephyr device_next USB stack must be compiled with the CDC-NCM device class enabled, and the network interface must be administratively up (IFACE_UP and DATA_IFACE_ENABLED flags set); (2) the USB host must perform a bus suspend - a standard operation during host sleep, USB selective suspend, or hub power management - causing usbd_ep_enqueue() to return -EPERM; and (3) at least one outbound network packet must arrive at cdc_ncm_send() during or immediately after the suspend event, before the driver's interface flags propagate the suspended state. No authentication, special privileges, or malicious host-side software is required; any USB host OS engaging standard power management satisfies condition (2). Exploitation is impossible without USB connectivity to the Zephyr device, and cannot occur without the CDC-NCM class being enabled in firmware. The deadlock is permanent and unrecoverable without rebooting the Zephyr device; the USB host is not affected.

The CVSS 5.3 Medium score accurately reflects the constrained attack surface: AV:A limits exposure to USB-connected or USB-networked adjacency, and AC:H captures the required timing coincidence between active device egress and a host-initiated bus suspend. Impact is purely availability (A:H, C:N, I:N), consistent with the description's explicit statement that there is no memory corruption or information disclosure. No EPSS score was provided and no CISA KEV listing exists, indicating no confirmed or widespread active exploitation. The threat actor in practice is not a malicious party but any standard USB host OS performing routine power management - host sleep, selective suspend, or hub power management are all standard, persistent host operations - making this a reliability defect with a security classification rather than a typical attack-surface vulnerability. Notably, the intelligence tags label this 'Buffer Overflow' and 'Information Disclosure,' which directly contradict the description and the CWE-833 (Deadlock) classification; those tags should be treated as mislabeled metadata and disregarded. The shared TX thread impact amplifies availability consequences in multi-interface Zephyr deployments beyond what the CVSS scope-unchanged rating implies at first glance.

A Zephyr-based IoT or embedded device using USB CDC-NCM for host connectivity is transmitting periodic telemetry or keepalive packets. The host OS enters sleep mode or enables USB selective suspend, triggering a standard bus suspend. The next outbound packet from the Zephyr network stack reaches cdc_ncm_send(), passes the IFACE_UP guard (flags not yet updated to reflect suspend), calls usbd_ep_enqueue() which returns -EPERM, then blocks forever on the synchronization semaphore - deadlocking the shared TX thread and halting all device network egress until power-cycled. No exploit code is required; any host OS performing routine power management is sufficient to trigger the condition.