CVE-2026-16148

Awaiting Analysis Awaiting Analysis - Queue

USB Work Queue Corruption in Zephyr RTOS Driver

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Zephyr Project

Description

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) inside it82xx2_enable() (the driver's .enable op) in drivers/usb/udc/udc_it82xx2.c. This work item is scheduled essentially continuously while the USB bus is active: the interrupt handler reschedules it on every SOF frame and suspended_handler() reschedules itself, so its timeout node is normally linked in the kernel timeout list / a workqueue pending queue. k_work_init_delayable() (kernel/work.c) unconditionally overwrites the entire k_work_delayable structure, including its timeout and queue linkage, with no busy check. Because it82xx2_disable() does not cancel the work, a normal disable-then-enable cycle re-runs api->enable() (udc_enable() only rejects a redundant enable, not a re-enable after disable) and re-initializes the still-pending work in place, corrupting the kernel timeout/workqueue linked lists and causing a kernel panic. An external USB host — for example a host performing USB DFU detach (dfu-util --detach) or forcing repeated attach/reset/re-enumeration — drives the udc_disable()/udc_enable() transitions and controls suspend/resume timing, so it can arrange for the suspend work to be pending across a re-enable. This yields an unauthenticated denial of service (kernel panic) reachable across the USB boundary from a removable, physically-connected host, with no confidentiality or integrity impact demonstrated. The fix moves the k_work_init_delayable() call into the one-time preinit function so the work is initialized exactly once, eliminating the re-initialization of an in-use item.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-16148

EUVD

EUVD-2026-77778

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	*
zephyrproject	zephyr	3.7.0
zephyrproject	zephyr	4.4.1
zephyrproject	zephyr	4.4.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-666	The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

Attack-Flow Graph

Executive Summary

This vulnerability is a kernel panic issue in the it82xx2 USB device controller driver within Zephyr RTOS. The driver's enable function re-initializes a delayable work item that may already be busy without checking its status. This corrupts kernel timeout and workqueue linked lists, causing a system crash. The issue is triggered externally via an unauthenticated USB host controlling suspend/resume timing.

Detection Guidance

This vulnerability is specific to the Zephyr RTOS it82xx2 USB device controller driver and requires kernel-level inspection. Detect it by checking the Zephyr version (3.7.0 to 4.4.1) and examining the driver code for improper work item re-initialization. No direct network detection commands apply.

Impact Analysis

This vulnerability allows an external attacker with physical access to a USB host to cause a kernel panic, resulting in a denial of service. The system becomes unresponsive, requiring a reboot. There is no impact on data confidentiality or integrity.

Mitigation Strategies

Upgrade Zephyr RTOS to version 4.4.2 or later, which includes the fix for this issue.
Apply the backported patches if using an earlier release line (3.7.0 to 4.4.1).
Avoid disabling and re-enabling the USB device controller repeatedly, as this triggers the vulnerable path.

Hi! I’m here to help you understand CVE-2026-16148. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70