CVE-2026-17050
Received Received - Intake

Double Free in Zephyr RTOS USB Host Stack

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Zephyr Project

Description
The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-length GET_DESCRIPTOR(CONFIGURATION) read, a mismatch between the short and full descriptor reads, and a rejected descriptor in parse_configuration_descriptor() — the buffer was released with k_heap_free() but the pointer was left dangling. The cleanup in usbh_device_free() is guarded only by if (udev->cfg_desc != NULL), so it frees the same block a second time. The path is driven entirely by the attached peripheral: usbh_device_connect() calls usbh_device_init(), which ends in usbh_device_set_configuration(), and on failure usbh_device_connect() calls usbh_device_free(). On v4.4.x this happens during the same enumeration, with no unplug required; on v4.1.0–v4.3.x the second free instead arrives via dev_removed_handler()/dev_connected_handler() in subsys/usb/host/usbh_core.c, so it requires a removal or duplicate-connect event after the failed enumeration — a sequence the attached device fully controls. A malicious or malformed USB device only has to answer the first 9-byte configuration-descriptor request with a well-formed header and then fail any of the three checks, for example by returning a full descriptor whose interface count disagrees with bNumInterfaces, or by answering the second read with different bytes. The result is a double free on usb_device_heap. On builds where lib/heap hardening is active (the current default CONFIG_SYS_HEAP_HARDENING_BASIC), sys_heap_free() detects the already-free chunk and calls k_panic(), giving a deterministic, peripheral-triggered denial of service of the USB host. On builds without that detection — earlier releases, or CONFIG_SYS_HEAP_HARDENING_NONE — the second free manipulates a chunk already on the free list, corrupting the heap's free list so that later allocations can return overlapping or invalid blocks. Exploitation beyond denial of service is bounded by the fact that usb_device_heap is a small dedicated heap (CONFIG_USBH_USB_DEVICE_HEAP, default 1024 bytes) whose only client is this descriptor buffer, and by CONFIG_USB_HOST_STACK being marked experimental and disabled by default. The fix sets udev->cfg_desc = NULL after every k_heap_free(), making the cleanup guard sound.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-17050
EUVD
EUVD-2026-84012

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
zephyrproject zephyr 4.1.0
zephyrproject zephyr 4.2.0
zephyrproject zephyr 4.3.0
zephyrproject zephyr 4.4.0
zephyrproject zephyr to 4.4.2 (exc)
zephyrproject zephyr 4.4.2
zephyrproject usb_host_stack From 4.1.0 (inc) to 4.4.x (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double-free vulnerability in the Zephyr RTOS USB host stack. When a USB device fails enumeration, the system allocates a configuration descriptor buffer from a dedicated heap. Due to improper cleanup, the buffer is freed but the pointer is not cleared, leading to a second free when cleanup occurs. This results in a double free of the same memory block.

Detection Guidance

This vulnerability is specific to the Zephyr RTOS USB host stack and requires direct access to the system running Zephyr. Detection involves checking for double-free conditions in the USB device heap during USB device enumeration failures. Monitor kernel logs for heap corruption or panic messages, especially after connecting a potentially malicious USB device. No network-specific commands apply as this is a local system issue.

Impact Analysis

The impact depends on heap hardening settings. With heap hardening enabled, it causes a deterministic denial of service by triggering a kernel panic. Without hardening, it corrupts the heap, potentially leading to overlapping or invalid memory allocations. Exploitation requires a malicious or malformed USB device.

Compliance Impact

This vulnerability primarily causes denial of service or heap corruption in the USB host stack, which does not directly relate to data privacy or security controls required by GDPR or HIPAA. However, if exploited, it could disrupt system availability, potentially impacting systems handling sensitive data subject to these regulations.

Mitigation Strategies
  • Upgrade Zephyr RTOS to version 4.4.2 or later where the vulnerability is fixed.
  • Disable the experimental USB host stack if not required, as the vulnerability is limited to this component.
  • Enable heap hardening (CONFIG_SYS_HEAP_HARDENING_BASIC) to mitigate denial of service impacts.
  • Avoid connecting untrusted USB devices to systems running affected Zephyr versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17050. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart