Zephyr USB Stack EUVD-2026-84012

Requires (1) CONFIG_USB_HOST_STACK enabled - it is experimental and disabled by default in Zephyr, so most builds are not affected; (2) physical access to attach a malicious or malformed USB peripheral (AV:P); and (3) the attacker-controlled device to return a valid 9-byte configuration-descriptor header and then fail one of three checks (failed full GET_DESCRIPTOR(CONFIGURATION), a short-vs-full descriptor mismatch, or a rejected descriptor in parse_configuration_descriptor - e.g. interface count disagreeing with bNumInterfaces). On v4.4.x the double free occurs within a single failed enumeration; on v4.1.0-v4.3.x it additionally requires a device-controlled removal or duplicate-connect event after the failed enumeration. Impact severity also depends on build config: CONFIG_SYS_HEAP_HARDENING_BASIC (default) yields a clean k_panic DoS, while CONFIG_SYS_HEAP_HARDENING_NONE or older releases permit free-list corruption.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, 5.7 MEDIUM) makes the decisive limitation explicit: AV:P means physical access is required - the attacker must physically attach a malicious or malformed USB device to a Zephyr host running the experimental USB host stack. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is no public exploit identified at time of analysis. The A:H is the dominant impact: on default builds (CONFIG_SYS_HEAP_HARDENING_BASIC) the double free is caught by sys_heap_free() which calls k_panic(), yielding a deterministic peripheral-triggered denial of service. The C:L/I:L reflect only the non-default weaker case (CONFIG_SYS_HEAP_HARDENING_NONE or older releases) where free-list corruption could yield overlapping/invalid allocations, but the description explicitly bounds this: usb_device_heap is a tiny dedicated 1024-byte heap whose sole client is the descriptor buffer, sharply limiting any escalation beyond DoS. Crucially, CONFIG_USB_HOST_STACK is marked experimental and disabled by default, so most fielded Zephyr deployments are not exposed at all. Signals are consistent - no conflict between CVSS, EPSS, and KEV; all point to a targeted, physical-access, DoS-grade issue rather than a widespread remote threat.

An attacker with brief physical access plugs a malicious or emulated USB device into a Zephyr host that has the experimental USB host stack enabled. The device answers the first 9-byte configuration-descriptor request with a well-formed header, then deliberately fails a validation check (e.g. returns a full descriptor whose interface count disagrees with bNumInterfaces, or answers the second read with different bytes), triggering the double free during enumeration. No public exploit code is known; the result is a k_panic denial of service on hardened builds, or heap free-list corruption on builds without heap hardening.