CVE-2026-10668: Zephyr NuMaker HSUSBD DoS Vulnerability

CVE-2026-10668 Overview

CVE-2026-10668 is a denial-of-service vulnerability in the Zephyr real-time operating system's Nuvoton NuMaker High-Speed USB Device (HSUSBD) controller driver at drivers/usb/udc/udc_numaker.c. The driver arms the control Data IN stage unconditionally by writing base->CEPTXCNT = len in numaker_hsusbd_ep_trigger. A USB host that cancels an in-flight control transfer and then issues a new SETUP packet can drive the driver out of sync. The control endpoint then transmits stale data or becomes permanently stuck NAK'ing every subsequent control transfer. The flaw is classified under [CWE-400] Uncontrolled Resource Consumption and affects boards using CONFIG_UDC_NUMAKER with DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED.

Critical Impact
A malicious or buggy USB host with physical or adjacent bus access can wedge the device's USB control endpoint, denying service to the device's USB function until a USB reset or physical re-plug.

Affected Products

Zephyr Project Zephyr RTOS (prior to v4.4.0)
Boards using the Nuvoton NuMaker HSUSBD controller with CONFIG_UDC_NUMAKER enabled
Devices with DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED in device tree configuration

Discovery Timeline

2026-07-12 - CVE-2026-10668 published to NVD
2026-07-16 - Last updated in NVD database
v4.4.0 - Fix shipped in Zephyr release

Technical Details for CVE-2026-10668

Vulnerability Analysis

The Nuvoton NuMaker HSUSBD driver mishandles the USB control transfer state machine. The function numaker_hsusbd_ep_trigger arms the control Data IN stage by writing the transfer length to the CEPTXCNT register without checking whether an IN token is actually pending or whether a new SETUP packet has arrived. The HSUSBD hardware cannot disarm a control Data IN transfer once armed for a previous transfer. When a host cancels an in-flight control transfer through timeout and then issues a new SETUP packet, the previously armed transfer remains queued. This desynchronizes driver state from hardware state.

Root Cause

The root cause is unconditional arming of the control Data IN stage. The driver does not synchronize the CEPTXCNT write with IN-token or new-SETUP events. Stale transfer data from the cancelled operation may be transmitted during the new transfer. The control endpoint may then enter a permanent NAK state on every subsequent control transfer. The FIFO copy loops remain bounded by net_buf length and the hardware BUFFULL flag, so no out-of-bounds access, use-after-free, or information leak occurs.

Attack Vector

An attacker with physical or adjacent access to the USB bus repeatedly cancels control transfers through timeout and issues new SETUP packets. This wedges the control endpoint of the target device. The device stops enumerating and stops responding on the control pipe until a USB reset or physical re-plug restores function. The impact is availability-only.

// Patch excerpt from drivers/usb/udc/udc_numaker.h
#define HSUSBD_CEPCTL_NAKCLR_Msk        0
#define HSUSBD_CEPINTEN_ERRIEN_Msk      0
#define HSUSBD_CEPINTEN_RXPKIEN_Msk     0
+#define HSUSBD_CEPINTEN_INTKIEN_Msk     0
#define HSUSBD_CEPINTEN_SETUPPKIEN_Msk  0
#define HSUSBD_CEPINTEN_SETUPTKIEN_Msk  0
#define HSUSBD_CEPINTEN_STALLIEN_Msk    0
#define HSUSBD_CEPINTEN_STSDONEIEN_Msk  0
#define HSUSBD_CEPINTEN_TXPKIEN_Msk     0
#define HSUSBD_CEPINTSTS_BUFEMPTYIF_Msk 0
#define HSUSBD_CEPINTSTS_BUFFULLIF_Msk  0
+#define HSUSBD_CEPINTSTS_INTKIF_Msk     0
#define HSUSBD_CEPINTSTS_RXPKIF_Msk     0
#define HSUSBD_CEPINTSTS_SETUPPKIF_Msk  0
#define HSUSBD_CEPINTSTS_SETUPTKIF_Msk  0
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f

The patch introduces the IN-token interrupt enable and status masks (INTKIEN, INTKIF) so the driver can wait for an IN token before arming Data IN. See the GitHub Commit Details.

Detection Methods for CVE-2026-10668

Indicators of Compromise

USB device stops enumerating and fails to respond on the control pipe (endpoint 0)
Repeated NAK responses from the control endpoint after cancelled SETUP transactions
Host-side USB stack timeouts on standard control requests such as GET_DESCRIPTOR or SET_CONFIGURATION
Device recovery only after USB bus reset or physical re-plug

Detection Strategies

Capture USB bus traces with a protocol analyzer to identify repeated SETUP-cancel-SETUP patterns targeting a device
Instrument the Zephyr build to log CEPTXCNT writes and correlate them with SETUP packet arrivals
Monitor host dmesg or equivalent USB subsystem logs for repeated enumeration failures on a specific device address

Monitoring Recommendations

Track USB device enumeration health metrics on production Zephyr firmware in physically accessible deployments
Alert on abnormal frequencies of USB port resets or re-enumeration events on host controllers connected to Zephyr devices
Log firmware version data across the fleet to identify Zephyr builds prior to v4.4.0 running the NuMaker HSUSBD driver

How to Mitigate CVE-2026-10668

Immediate Actions Required

Upgrade affected devices to Zephyr v4.4.0 or later, which includes the fix in commit 48e00332
Inventory boards using CONFIG_UDC_NUMAKER with DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED and prioritize them for firmware update
Restrict physical access to USB ports on affected devices in production environments

Patch Information

The fix is available in Zephyr v4.4.0. The patch monitors IN-token and new-SETUP events using a k_event primitive and arms control Data IN only when an IN token is present and no new SETUP has arrived. The driver cancels the current transfer on a new SETUP. The Kconfig.numaker file was updated to select EVENTS. Full details are in the GitHub Security Advisory.

Workarounds

Physically secure USB ports on deployed devices to prevent adjacent attackers from driving cancel-and-re-SETUP patterns
Implement watchdog logic that resets the USB peripheral when the control endpoint stops responding for a defined interval
Where feasible, disable the HSUSBD controller entirely on devices that do not require USB device functionality

bash

# Verify Zephyr version and rebuild against v4.4.0 or later
west list zephyr
cd zephyr
git fetch --tags
git checkout v4.4.0
west build -b <numaker_board> samples/subsys/usb/cdc_acm