CVE-2026-10663: Zephyr USB Host Use-After-Free Flaw

CVE-2026-10663 Overview

CVE-2026-10663 affects Zephyr RTOS's experimental USB host stack (CONFIG_USB_HOST_STACK). The flaw is a use-after-free and double-free condition in usbh_device_disconnect() within subsys/usb/host/usbh_device.c. The function frees the root usb_device slab object without clearing the cached ctx->root pointer, leaving a dangling reference.

An attacker with physical USB access can trigger a second device-removed event after a root disconnect. This causes the handler to re-enter usbh_device_disconnect() with the stale pointer, locking a mutex inside freed memory and calling k_mem_slab_free() on the already-freed block [CWE-416].

Critical Impact
Physical attackers or rogue USB devices can trigger memory corruption and denial of service on Zephyr-based devices running the experimental USB host stack.

Affected Products

Zephyrproject Zephyr (versions starting v4.4.0)
Devices using UHC controller drivers uhc_max3421e and uhc_mcux_common
Any Zephyr build with CONFIG_USB_HOST_STACK enabled

Discovery Timeline

2026-07-12 - CVE-2026-10663 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-10663

Vulnerability Analysis

The flaw resides in Zephyr's experimental USB host stack lifecycle management. When usbh_device_disconnect() in subsys/usb/host/usbh_device.c frees the root usb_device slab object, it does not clear the cached ctx->root pointer. The bus removal handler dev_removed_handler() in subsys/usb/host/usbh_core.c decides what to tear down based solely on ctx->root, checking only that it is non-NULL.

UHC controller drivers such as uhc_max3421e and uhc_mcux_common synthesize UHC_EVT_DEV_REMOVED events directly from physical bus line state. These drivers apply no debounce logic or state guard. This allows a second device-removed event to be delivered after a legitimate root disconnect.

Root Cause

The regression was introduced in Zephyr v4.4.0 by the connect/disconnect refactor. The ctx->root pointer remains set after the underlying slab object is freed. On the second removal event, the handler re-enters usbh_device_disconnect() with the dangling pointer, locks a mutex inside freed memory (use-after-free), removes the freed node from the device list, and calls k_mem_slab_free() on the already-freed block (double-free).

Attack Vector

The attack vector is physical or local. An attacker with USB access, or a rogue device that intentionally bounces its connection state, can deliver two removal events in sequence. If the slab block has been reissued to a newly attached device between events, the corruption affects a live object rather than freed memory, extending the impact beyond a simple crash.

// Patch: subsys/usb/host/usbh_device.c - clear ctx->root before free
	udev->state = USB_STATE_DEFAULT;

+	if (ctx->root == NULL) {
+		ctx->root = udev;
+	}
+
	err = usbh_device_init(udev);
	if (err != 0) {
		LOG_ERR("Failed to init new USB device");

Source: Zephyr commit 4b87a8f

// Patch: subsys/usb/host/usbh_core.c - remove duplicate root assignment
		udev->speed = USB_SPEED_SPEED_FS;
	}

-	if (ctx->root == NULL) {
-		ctx->root = udev;
-	}
-
	usbh_device_connect(ctx, udev);
}

Source: Zephyr commit 4b87a8f

Detection Methods for CVE-2026-10663

Indicators of Compromise

Unexpected device crashes or resets shortly after USB device removal events
Kernel fault logs referencing usbh_device_disconnect, k_mem_slab_free, or mutex operations on freed memory
Rapid connect/disconnect cycles on USB ports paired with system instability

Detection Strategies

Enable Zephyr memory debugging options (CONFIG_MEM_SLAB_TRACE, sanitizer builds) to catch double-free conditions during test
Review UHC driver logs for repeated UHC_EVT_DEV_REMOVED events without an intervening connect event
Monitor firmware crash telemetry for stack traces terminating inside USB host lifecycle functions

Monitoring Recommendations

Track firmware versions across fielded Zephyr devices to identify builds at or above v4.4.0 that ship the experimental host stack
Instrument UHC drivers with counters for consecutive removal events to detect malicious bus bouncing
Capture and archive kernel panic dumps from IoT devices to identify use-after-free patterns tied to USB events

How to Mitigate CVE-2026-10663

Immediate Actions Required

Apply the upstream fix from Zephyr commit 4b87a8f161a44cb19505fa97db7cf72f64d49165 to any downstream fork of the RTOS
Restrict physical USB access on production devices running the experimental host stack
Disable CONFIG_USB_HOST_STACK on builds where USB host functionality is not required

Patch Information

The fix clears ctx->root in usbh_device_disconnect() before freeing the slab object and relocates the root assignment into usbh_device_init flow. The patch is available in the Zephyr commit 4b87a8f. Details are documented in GitHub Security Advisory GHSA-26q8-xjq3-f5p6.

Workarounds

Physically block or seal USB ports on deployed devices until firmware is updated
Add debounce or state-guard logic in downstream UHC driver forks to reject duplicate UHC_EVT_DEV_REMOVED events
Rebuild firmware with CONFIG_USB_HOST_STACK=n where USB host operation is optional

bash

# Fetch and apply the upstream fix in a Zephyr workspace
cd zephyr
git fetch origin
git cherry-pick 4b87a8f161a44cb19505fa97db7cf72f64d49165
west build -b <board> <application> --pristine