USB Control Endpoint Denial of Service in Nuvoton NuMaker HSUSBD

Executive Summary

The CVE-2026-10668 vulnerability affects the Nuvoton NuMaker HSUSBD USB device-controller driver in the Zephyr RTOS. The issue arises because the driver unconditionally arms the control Data IN stage, which the hardware cannot disarm if a previous transfer is still armed. When a USB host cancels an ongoing control transfer and sends a new SETUP packet, this causes the driver to become desynchronized. As a result, stale data may be sent in the new transfer, and the control endpoint can become permanently stuck in a NAK state, preventing further control transfers.

This desynchronization effectively denies service to the device's USB function until a USB reset or re-plug occurs. The flaw is an availability-only denial-of-service issue and does not cause memory safety problems such as out-of-bounds access or information leaks.

The fix involves monitoring IN-token and new SETUP events to ensure the control Data IN stage is only armed when an IN token is present and no new SETUP has arrived, canceling the current transfer if a new SETUP is detected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service on devices using the affected USB controller driver. A malicious or buggy USB host can repeatedly cancel and resend SETUP packets, causing the device's USB control endpoint to become stuck in a NAK state.

As a result, the device will stop enumerating or responding on the control pipe, effectively disabling its USB functionality until the device is reset or unplugged and plugged back in.

The impact is limited to availability, with no effect on confidentiality or integrity, and exploitation requires physical or adjacent access to the USB bus.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability causes the USB control endpoint on affected devices to become permanently stuck in a NAK state after a host cancels an in-flight control transfer and issues a new SETUP packet. Detection can be based on observing that the device stops enumerating or responding on the USB control pipe.

Since the issue is related to USB control transfers being stuck and denial of service on the USB function, monitoring USB device enumeration failures or repeated NAK responses on control endpoints can indicate the presence of this vulnerability.

Specific commands to detect this condition are not provided in the available resources. However, USB traffic analysis tools (e.g., usbmon on Linux or Wireshark with USB capture) can be used to monitor control transfer cancellations and repeated SETUP packets followed by NAK responses.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves applying the fix introduced in Zephyr RTOS versions after 4.4.0 and before 4.5.0, which monitors IN-token and new SETUP events to ensure control Data IN is only armed when appropriate, cancelling current transfers on new SETUP packets.

If updating the Zephyr RTOS or the Nuvoton NuMaker HSUSBD driver is not immediately possible, a temporary mitigation is to reset or re-plug the USB device to recover from the stuck NAK state caused by the vulnerability.

Additionally, restricting physical or adjacent attacker access to the USB bus can reduce the risk, as exploitation requires a malicious or buggy host physically connected to the USB bus.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is an availability-only denial-of-service (DoS) issue that affects the USB control endpoint of devices using the Nuvoton NuMaker HSUSBD controller. It does not impact confidentiality or integrity, and there are no memory safety violations or information leaks involved.

Because the flaw only causes denial of service and does not expose or compromise sensitive data, it has limited direct impact on compliance with data protection standards and regulations such as GDPR or HIPAA, which primarily focus on confidentiality and integrity of personal or protected health information.

However, the denial of service could affect availability requirements under some regulations if the affected device is critical for maintaining compliant operations or services.

Useful 0 Not Useful 0