CVE-2026-12051
Received Received - Intake

NULL Pointer Dereference in Zephyr RTOS USB DFU Class

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Zephyr Project

Description
The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/usb/device_next/class/usbd_dfu.c). The handler computes MIN(setup->wLength, buf->len) and passes buf->data to the image write callback without checking that the buf net_buf pointer is non-NULL. The handler is reached over the USB control endpoint, driven by the USB host. For a DFU_DNLOAD (download) request with no Data OUT stage — notably the zero-length terminating download that the DFU protocol uses to end a firmware transfer — the USB core invokes the class handler with a NULL buffer. After the device has been advanced to the DFU_DNLOAD_IDLE state (by sending one valid download block and a GET_STATUS), a zero-length DFU_DNLOAD reaches handle_download() with buf == NULL, dereferencing it. The result is a NULL+offset read that triggers a fatal CPU fault, i.e. a denial of service (device crash/reset). The attacker is whatever controls the USB host the device is attached to; DFU download support must be enabled with a registered image. There is no memory corruption or information disclosure — impact is limited to availability. The fix adds an explicit if (buf != NULL) guard so the callback receives a zero-length, NULL-data transfer instead of crashing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-12051
EUVD
EUVD-2026-55939

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zephyrproject zephyr From 4.4.0 (inc) to 4.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-12051 is a NULL pointer dereference flaw in Zephyr RTOS's experimental USB device stack. It occurs in the USB Device Firmware Upgrade (DFU) class implementation when handling a zero-length DFU_DNLOAD request. The handle_download() function fails to check if the buffer pointer is NULL before accessing it, causing a fatal CPU fault and device crash.

Detection Guidance

Detection requires checking if Zephyr RTOS with the experimental device_next USB stack is running and if DFU download support is enabled. Inspect the device logs for USB DFU class handler crashes or resets during firmware updates. No direct network detection commands exist; focus on device logs and USB host interactions.

Impact Analysis

This vulnerability allows an attacker controlling the USB host to crash or reset the device by sending a malicious DFU_DNLOAD request. The impact is limited to availability loss (device crash) with no memory corruption or data disclosure. Affected devices must have DFU download support enabled with a registered image.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the device, which could impact availability of systems handling sensitive data. For GDPR, availability is part of data integrity and security requirements, so repeated crashes could affect compliance. For HIPAA, device reliability is critical for maintaining access to protected health information; crashes could disrupt operations and violate security standards.

Mitigation Strategies

Upgrade Zephyr RTOS to v4.5.0 or apply patches for v4.4.x or v4.3.x branches. Disable DFU download support if not required. Monitor USB host interactions to prevent zero-length DFU_DNLOAD requests. Apply the NULL check fix in handle_download() if custom builds are used.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12051. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart