What is the CVSS score of CVE-2026-10668?

CVE-2026-10668 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-10668?

Yes, a patch is available for CVE-2026-10668. Update the affected software to the latest version immediately.

Zephyr RTOS CVE-2026-10668

EUVD-2026-43245 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-12 zephyr

Denial Of Service Zephyr Zephyrproject

4.6

CVSS 3.1 · NVD

Severity by source

Vendor (zephyr) PRIMARY

LOW

qualitative

NVD

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

2.4 LOW

Physical USB bus control required (AV:P); attacker needs no privileges on device (PR:N); impact is availability-only and limited to USB function (A:L, C:N, I:N).

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jul 16, 2026 - 20:07 NVD

LOW MEDIUM

CVSS changed

Jul 16, 2026 - 20:07 NVD

2.4 (LOW) 4.6 (MEDIUM)

Analysis Generated

Jul 12, 2026 - 17:20 vuln.today

DescriptionNVD

The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len in numaker_hsusbd_ep_trigger). Because the HSUSBD hardware cannot disarm a control Data IN already armed for a previous transfer, a USB host that cancels an in-flight control transfer (timeout) and then issues a new SETUP packet can drive the driver out of sync: stale data may be transmitted in the new transfer and the control endpoint can become permanently stuck NAK'ing every subsequent control transfer.

A malicious or buggy host (physical/adjacent attacker driving the bus) can repeatedly cancel-and-re-SETUP to wedge the device's USB control endpoint, denying service to the device's USB function (the device stops enumerating/responding on the control pipe) until a USB reset or re-plug. The flaw is an availability-only denial of service; the FIFO copy loops (bounded by net_buf length and the hardware BUFFULL flag) and the net_buf lifecycle are independent of the arming desync, so there is no out-of-bounds access, use-after-free, or information leak.

The fix monitors the IN-token and new-SETUP events (k_event) and only arms control Data IN when an IN token is present and no new SETUP has arrived, cancelling the current transfer on a new SETUP. Affects boards using the Nuvoton NuMaker HSUSBD controller (CONFIG_UDC_NUMAKER with DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED); shipped in v4.4.0.

AnalysisAI

Denial of service in Zephyr RTOS's Nuvoton NuMaker HSUSBD USB device-controller driver allows a physical or adjacent USB host to permanently wedge the device's USB control endpoint. The driver unconditionally arms the control Data IN stage without accounting for the hardware's inability to disarm an already-armed transfer, so a host that cancels an in-flight control transfer and then re-issues a SETUP packet drives the driver out of sync. Repeated cancel-and-re-SETUP cycles cause the control endpoint to NAK every subsequent transfer, rendering the USB function non-operational until a USB reset or re-plug. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Zephyr RTOS USB Device Controller (UDC) subsystem, specifically in drivers/usb/udc/udc_numaker.c, which implements support for the Nuvoton NuMaker HSUSBD peripheral. The root cause, classified under CWE-400 (Uncontrolled Resource Consumption / improper state management), is that the function numaker_hsusbd_ep_trigger unconditionally writes the transfer length to the hardware register base->CEPTXCNT to arm the control Data IN stage. The Nuvoton HSUSBD hardware enforces a constraint that a control Data IN transfer, once armed, cannot be disarmed by software. When a USB host issues a SETUP packet mid-transfer (a valid behavior during host-side timeouts or cancellation), the driver's internal state and hardware state become permanently desynchronized. The affected CPE is cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*, and the flaw is gated behind the Kconfig option CONFIG_UDC_NUMAKER with the devicetree node DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED, meaning only boards physically equipped with this Nuvoton controller are affected.

RemediationAI

The upstream fix is available as commit 48e003326873e8bbc0ee4b67334e0dd8b5fb890f in the Zephyr project repository at https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f. The patch introduces k_event-based monitoring of IN-token and new-SETUP events, ensuring the driver only arms control Data IN when an IN token is present and no new SETUP has arrived, and cancels the current transfer upon receiving a new SETUP. Product teams shipping firmware based on Zephyr v4.4.0 with Nuvoton NuMaker HSUSBD should apply this commit or upgrade to a release that incorporates it; a specific patched release version was not independently confirmed from the available data (upstream fix is at the commit level only). As a compensating control where patching is not immediately feasible, restricting physical USB port access to trusted hosts reduces exposure, though this is only practical in controlled deployment environments such as industrial or medical devices. Disabling CONFIG_UDC_NUMAKER entirely would eliminate the vulnerability if the USB device function is not required for the product's operation.