What is the CVSS score of CVE-2026-10656?

CVE-2026-10656 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-10656?

Yes, a patch is available for CVE-2026-10656. Update the affected software to the latest version immediately.

Zephyr RTOS CVE-2026-10656

MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-05 zephyr

Denial Of Service Null Pointer Dereference Zephyr

4.6

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.6 MEDIUM

Physical USB bus access required (AV:P); attacker acts as USB host needing no credentials (PR:N); impact is crash only with no confidentiality or integrity effect (A:H, C:N, I:N).

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 23:17 vuln.today

DescriptionCVE.org

The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c, compatible adi_max32_usbhs) dereferenced an endpoint buffer in its OUT and IN transfer-completion handlers without checking it for NULL. udc_event_xfer_out_done() called net_buf_add(buf, ep_request->actlen) immediately after buf = udc_buf_get(ep_cfg), where udc_buf_get() returns NULL when the endpoint FIFO is empty. A transfer-completion event is queued from interrupt context and processed asynchronously by the driver thread; between queuing and processing, the endpoint FIFO can be drained by host-controlled control flow - in particular udc_setup_received() drains the EP0 OUT/IN FIFOs whenever a new SETUP packet arrives, and dequeue/disable/purge paths drain it likewise. A USB host that aborts an in-flight EP0 control transfer with a new SETUP packet (legal USB behavior) can therefore cause a stale XFER_OUT_DONE event to be processed against an empty FIFO, producing net_buf_add(NULL, ...), a near-NULL pointer dereference that faults and crashes the device. No authentication is required; the attacker is the USB host the device is connected to (physical bus access). Impact is denial of service (device crash). The defect was introduced when the MAX32 UDC driver was added and shipped in Zephyr v4.4.0. The fix adds NULL-buffer checks that return early with UDC_EVT_ERROR/-ENOBUFS in both the OUT-done and IN-done handlers.

AnalysisAI

NULL pointer dereference in the Zephyr RTOS MAX32xxx USB device controller driver (udc_max32.c) crashes devices running Zephyr v4.4.0 when a physically connected USB host aborts an in-flight EP0 control transfer by sending a new SETUP packet - a completely legal USB protocol action. The race condition between interrupt-queued transfer-completion events and asynchronous FIFO draining by the driver thread causes net_buf_add(NULL, ...) when udc_buf_get() returns NULL on an empty FIFO, producing a near-NULL pointer dereference and device fault. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis; real-world risk is constrained by the physical access prerequisite and the specific MAX32xxx hardware dependency.

Technical ContextAI

The defect resides in drivers/usb/udc/udc_max32.c, the Zephyr USB Device Controller driver for Analog Devices (formerly Maxim) MAX32xxx microcontrollers (DTS compatible string adi_max32_usbhs). CWE-476 (NULL Pointer Dereference) captures the root cause: udc_buf_get(ep_cfg) returns NULL when the endpoint FIFO is empty, and the return value is passed directly to net_buf_add() without a NULL guard. The architectural vulnerability stems from Zephyr's split interrupt/thread model: transfer-completion events (XFER_OUT_DONE, XFER_IN_DONE) are queued in interrupt context but processed asynchronously by the driver thread. During this window, the EP0 OUT/IN FIFOs can be legitimately drained by udc_setup_received() - which clears both FIFOs on any new SETUP packet - or by dequeue/disable/purge paths. Because USB hosts are permitted by the USB specification to send a new SETUP packet at any time to abort a pending control transfer, the triggering condition is achievable through standards-compliant host behavior without any exploit-specific tooling. The CPE cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:* with a wildcard version reflects that the flaw was introduced at v4.4.0 when the driver was first merged.

RemediationAI

Apply the upstream Zephyr fix available at commit a0d8f786559355fb3b38e34799e1ae491ba9545c (https://github.com/zephyrproject-rtos/zephyr/commit/a0d8f786559355fb3b38e34799e1ae491ba9545c), which adds NULL-buffer checks in both udc_event_xfer_out_done() and the IN-done handler that return early with UDC_EVT_ERROR/-ENOBUFS when udc_buf_get() returns NULL. A specific patched release version is not independently confirmed from the available references - the fix is available as an upstream commit, so downstream integrators and SDK vendors should verify when the fix is included in a tagged Zephyr release via the security advisory at https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-58p9-6mjq-rf2m. As a compensating control where patching is not immediately possible, restricting USB port access to trusted hosts (physical port locks, USB host authentication dongles, or disabling the USB device role at the application layer if not functionally required) eliminates the attack vector entirely without software trade-offs. Disabling the USB interface removes all USB-dependent functionality, which may be unacceptable in production.