Zephyr EUVD-2026-12190

CVSS 6.1 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H reflects local-only attack vector (low risk for remote exploitation), low attack complexity (triggering the loop condition is straightforward once identified), and low privilege requirement. The availability impact is HIGH (system DoS), with minor integrity impact and no confidentiality impact. The attack requires local access and existing user-level privileges—realistic for embedded device scenarios where an attacker has shell access or can craft malicious USB communications locally. No KEV (Known Exploited Vulnerability) status or public POC was identified in the provided intelligence, reducing real-world exploitation likelihood. This is a legitimate priority for embedded/IoT deployments of Zephyr (particularly STM32-based products), but NOT a critical remote threat; patch urgency depends on deployment model and exposure of the affected driver.

An attacker with local shell access or physical USB access to an STM32-based IoT device running Zephyr ≤4.3 with USB device driver enabled crafts or sends a specially formed USB packet or sequence of control requests that triggers the infinite loop condition in usb_dc_stm32.c. The loop executes without exit, consuming 100% CPU and preventing legitimate operations (timers, other tasks, communication). The device becomes unresponsive for its intended purpose (e.g., sensor data collection, remote communication) until power-cycled. In a deployed smart home or industrial IoT setting, this results in denial of service of critical functionality. Attack complexity is LOW—once the triggering condition is identified, it can be reliably reproduced via USB fuzzing or low-level driver manipulation. No authentication or elevation beyond local user is required if the attacker has access to USB subsystem or local process execution.