What is the CVSS score of CVE-2026-10663?

CVE-2026-10663 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-10663?

Yes, a patch is available for CVE-2026-10663. Update the affected software to the latest version immediately.

Zephyr RTOS CVE-2026-10663

EUVD-2026-43240 MEDIUM

Use After Free (CWE-416)

2026-07-12 zephyr

Buffer Overflow Denial Of Service Use After Free Memory Corruption Zephyr Zephyrproject

6.1

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

6.1 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

6.1 MEDIUM

AV:P because exploitation strictly requires physical USB access; PR:N since no software credentials are needed to manipulate hardware bus state; C:N as no data is disclosed.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 17:30 vuln.today

DescriptionCVE.org

In Zephyr's experimental USB host stack (CONFIG_USB_HOST_STACK), usbh_device_disconnect() (subsys/usb/host/usbh_device.c) freed the root usb_device slab object without clearing the cached pointer ctx->root. The bus removal handler dev_removed_handler() (subsys/usb/host/usbh_core.c) decides what to tear down solely from ctx->root, checking only that it is non-NULL.

Because UHC controller drivers (e.g. uhc_max3421e, uhc_mcux_common) synthesize UHC_EVT_DEV_REMOVED directly from physical bus line state with no debounce or state guard, an attacker with physical USB access (or a rogue device that bounces its connection) can deliver a second device-removed event after a root device disconnect. The handler then re-enters usbh_device_disconnect() with the dangling pointer, locking a mutex inside the freed object (use-after-free), removing the freed node from the device list, and calling k_mem_slab_free() on the already-freed block (double-free). If the slab block has been reissued to a newly attached device in between, this corrupts a live object.

Impact is denial of service (crash) and memory corruption; the attack vector is physical/local. The flaw was introduced in v4.4.0 by the connect/disconnect refactor and is fixed by clearing ctx->root in usbh_device_disconnect() before freeing.

AnalysisAI

Use-after-free and double-free in Zephyr RTOS's experimental USB host stack (CONFIG_USB_HOST_STACK, introduced in v4.4.0) allows an attacker with physical USB access to crash the target device or corrupt live kernel slab objects by bouncing a USB device connection to trigger a second removal event after the slab has already been freed. The flaw exists because usbh_device_disconnect() frees the root usb_device slab object without clearing the cached ctx->root pointer, and UHC controller drivers (uhc_max3421e, uhc_mcux_common) emit UHC_EVT_DEV_REMOVED directly from hardware line-state with no debounce or re-entry guard. No public exploit identified at time of analysis, and no CISA KEV listing; the physical-access prerequisite substantially constrains the realistic attacker population.

Technical ContextAI

Zephyr RTOS is an open-source real-time operating system targeting constrained embedded and IoT devices. The affected component is the experimental USB host stack (CONFIG_USB_HOST_STACK), a Kconfig-guarded subsystem that is disabled by default. The root cause maps to CWE-416 (Use After Free): usbh_device_disconnect() in subsys/usb/host/usbh_device.c calls k_mem_slab_free() on the root usb_device slab object but leaves ctx->root pointing to the now-freed memory. The companion issue is a double-free: dev_removed_handler() in subsys/usb/host/usbh_core.c uses ctx->root as its sole decision signal, checking only that it is non-NULL before re-entering usbh_device_disconnect(). UHC controller drivers such as uhc_max3421e and uhc_mcux_common synthesize UHC_EVT_DEV_REMOVED directly from physical USB bus line state without debounce logic or a state guard, meaning any physical connect/disconnect bounce can produce a second event. If the freed slab block is reallocated to a new device between the two events, the second re-entry corrupts a live object rather than the freed one. CPE cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:* covers all Zephyr versions per NVD, though the flaw was introduced in v4.4.0 by the connect/disconnect refactor.

RemediationAI

Apply the upstream fix available in commit 4b87a8f161a44cb19505fa97db7cf72f64d49165 (https://github.com/zephyrproject-rtos/zephyr/commit/4b87a8f161a44cb19505fa97db7cf72f64d49165), which resolves the vulnerability by clearing ctx->root in usbh_device_disconnect() before calling k_mem_slab_free(), breaking the dangling-pointer re-entry path. A specific tagged release version incorporating this commit has not been independently confirmed from available data - monitor the Zephyr release notes and the GHSA advisory (https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-26q8-xjq3-f5p6) for the first tagged release that includes this commit. As a compensating control for devices that cannot be immediately patched, disable CONFIG_USB_HOST_STACK in the Zephyr build configuration if USB host functionality is not required; since this feature is experimental and off by default, disabling it eliminates the vulnerable code path entirely with no functional impact on non-USB-host workloads. For deployed hardware where USB host is necessary and patching is delayed, restrict physical access to USB ports via tamper-evident covers or hardware-level port disabling, accepting the trade-off of reduced device serviceability.