Zephyr RTOS CVE-2026-10663

Exploitation requires all three of the following: (1) physical USB port access to the target device, or control of a USB device capable of programmatically bouncing its connection state (e.g., a malicious USB gadget toggling D+/D- line state); (2) the target Zephyr firmware must be compiled with CONFIG_USB_HOST_STACK=y, an experimental Kconfig option that is disabled by default; and (3) the Zephyr version must be 4.4.0 or later, as the vulnerable connect/disconnect refactor was introduced in that release. Limiting factors are significant: the experimental USB host stack is not present in default Zephyr builds, so the affected population is a narrow subset of an already-niche RTOS ecosystem; the attack vector is strictly physical (AV:P per CVSS), precluding any remote or network-based exploitation; and no system account credentials or elevated software privileges are needed - the attack surface is entirely at the hardware-interface layer. There is no user interaction required once physical access is established.

CVSS 6.1 (Medium) with AV:P accurately reflects the physical-access requirement, which is the primary risk-limiting factor - remote or network exploitation is not possible. EPSS data is not available in the provided intelligence; no KEV listing and no public proof-of-concept code are confirmed, so this is no confirmed active exploitation scenario. The high Integrity and Availability sub-scores (both H) are warranted: in constrained embedded environments, slab memory corruption can yield stronger exploit primitives than on general-purpose OSes, potentially escalating beyond a simple crash. However, the experimental nature of CONFIG_USB_HOST_STACK - disabled by default - means the vulnerable population is a narrow subset of an already-niche RTOS ecosystem. Real-world priority is low for most Zephyr users but elevated for any deployment with USB host support enabled in physically accessible environments (industrial kiosks, public-facing IoT controllers, USB charging aggregators). No conflicting signals exist in the available data: CVSS vector, description, and tags (Use After Free, Memory Corruption, Denial Of Service) are mutually consistent.

An attacker with physical access to a Zephyr-based device (such as an industrial IoT controller or USB hub aggregator) built with CONFIG_USB_HOST_STACK enabled connects a purpose-built rogue USB device capable of rapidly toggling its D+/D- line state. The attacker disconnects the device, which causes usbh_device_disconnect() to free the usb_device slab while leaving ctx->root dangling; a near-immediate reconnect-and-disconnect bounce causes the debounce-free UHC driver to fire a second UHC_EVT_DEV_REMOVED, re-entering the handler with the stale pointer and triggering the use-after-free and double-free. No public proof-of-concept code is known at time of analysis.