CVE-2026-12051: Zephyr USB DFU NULL Pointer DoS Flaw

CVE-2026-12051 Overview

CVE-2026-12051 is a NULL pointer dereference vulnerability [CWE-476] in the USB Device Firmware Upgrade (DFU) class implementation of Zephyr's experimental device_next USB device stack. The flaw resides in the handle_download() function in subsys/usb/device_next/class/usbd_dfu.c. When a DFU_DNLOAD request arrives with no Data OUT stage, the USB core invokes the class handler with a NULL net_buf pointer. The handler dereferences that pointer without a guard, triggering a fatal CPU fault. The result is a denial-of-service condition on the target device.

Critical Impact
An attacker with control of the USB host can crash or reset a Zephyr device that has DFU download support enabled, causing loss of availability. There is no memory corruption or information disclosure.

Affected Products

Zephyr RTOS device_next USB device stack (experimental)
Zephyr USB DFU class implementation (subsys/usb/device_next/class/usbd_dfu.c)
Zephyr-based embedded devices with DFU download support enabled and a registered image

Discovery Timeline

2026-08-11 - CVE-2026-12051 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-12051

Vulnerability Analysis

The vulnerability affects the DFU download state machine in Zephyr's experimental device_next USB stack. The DFU protocol uses a zero-length DFU_DNLOAD request to signal the end of a firmware transfer. When the USB core receives such a request with no Data OUT stage, it invokes handle_download() with buf == NULL.

The handler computes MIN(setup->wLength, buf->len) and passes buf->data to the image write callback without checking whether buf is non-NULL. Dereferencing the NULL pointer causes a NULL+offset read that triggers a fatal CPU fault on the microcontroller, crashing or resetting the device.

The attack is reachable only after the device has been advanced to the DFU_DNLOAD_IDLE state by sending one valid download block followed by a GET_STATUS request. From that state, a single zero-length DFU_DNLOAD request suffices to trigger the crash.

Root Cause

The handler assumed that a valid net_buf structure would always accompany a DFU_DNLOAD request. The DFU specification allows zero-length terminating downloads, and the Zephyr USB core delivers these with a NULL buffer pointer. The missing if (buf != NULL) guard before dereferencing buf->len and buf->data is the direct root cause.

Attack Vector

Exploitation requires physical access to the USB port of a Zephyr device that has DFU download support compiled in with a registered image. The attacker controls the USB host and issues a scripted DFU sequence: one valid download block, a GET_STATUS to reach DFU_DNLOAD_IDLE, then a zero-length DFU_DNLOAD. No authentication is required at the USB level. Impact is limited to availability - the device faults and resets.

// Patch: subsys/usb/device_next/class/usbd_dfu.c
// usb: device_next: dfu: fix the possible null pointer dereference
{
	struct usbd_dfu_data *data = usbd_class_get_private(c_data);
	struct usbd_dfu_image *const image = data->image;
-	uint16_t size = MIN(setup->wLength, buf->len);
+	const uint8_t *buf_data = NULL;
+	uint16_t size = 0;
	int ret;

-	ret = image->write_cb(image->priv, setup->wValue, size, buf->data);
+	if (buf != NULL) {
+		size = MIN(setup->wLength, buf->len);
+		buf_data = buf->data;
+	}
+
+	ret = image->write_cb(image->priv, setup->wValue, size, buf_data);
	if (ret < 0) {
		errno = -ENOTSUP;
		dfu_error(c_data, DFU_ERROR, ERR_UNKNOWN);

Source: Zephyr GitHub Commit 552ca371

Detection Methods for CVE-2026-12051

Indicators of Compromise

Unexpected device resets or fatal CPU fault log entries on Zephyr devices immediately following USB DFU activity.
Presence of DFU_DNLOAD control transfers with wLength == 0 on the USB bus targeting a device in DFU_DNLOAD_IDLE state.
Repeated device reboots correlated with USB host connection events.

Detection Strategies

Capture and inspect USB control-transfer traces for zero-length DFU_DNLOAD requests preceded by a valid block and a GET_STATUS sequence.
Enable Zephyr fault logging and review crash dumps for faults originating in handle_download() within usbd_dfu.c.
Correlate USB host connection events with device availability metrics collected by fleet-management tooling.

Monitoring Recommendations

Monitor device uptime and reset counters for embedded fleets running Zephyr with USB DFU enabled.
Alert on physical USB connections to production devices where DFU is not part of normal operation.
Review firmware build configurations to identify devices shipping with CONFIG_USBD_DFU enabled in production images.

How to Mitigate CVE-2026-12051

Immediate Actions Required

Apply the upstream Zephyr fix from commit 552ca371257597b71490482d5cc597157ea60f12 to affected firmware trees and rebuild device images.
Disable USB DFU download support in production firmware builds where field-upgrade over USB is not required.
Restrict physical access to USB ports on deployed devices, particularly for devices in sensitive or unattended environments.

Patch Information

The fix is available in the Zephyr project via commit 552ca371 and is documented in the Zephyr Security Advisory GHSA-vhvq-q6rw-jvm4. The patch adds an explicit if (buf != NULL) guard so the image write callback receives a zero-length, NULL-data transfer instead of dereferencing a NULL pointer.

Workarounds

Remove CONFIG_USBD_DFU from production Kconfig files if DFU is not required.
Ship production images without a registered DFU image, which prevents the vulnerable code path from being reached.
Use tamper-evident enclosures or disable USB peripherals in hardware for devices deployed in untrusted physical environments.

bash

# Kconfig example: disable USB DFU in production builds
# prj.conf
CONFIG_USBD_DFU=n

# Or, if keeping DFU enabled, ensure the tree includes the fix commit
git -C zephyr log --oneline | grep 552ca371