CVE-2026-12052: Zephyr USB CDC NCM DoS Vulnerability

CVE-2026-12052 Overview

CVE-2026-12052 is an out-of-bounds write [CWE-787] in the Zephyr RTOS USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth located in subsys/usb/device_next/class/usbd_cdc_ncm.c. The handler responds to the GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE class requests by copying fixed-size structures into the control DATA IN buffer while ignoring the host-supplied wLength. When a host issues these requests with a wLength smaller than the response structure, the handler writes up to 27 bytes past the end of the allocated pool buffer. Any host or USB interposer connected to an affected Zephyr device can trigger the overflow without authentication.

Critical Impact
Physical USB attackers can corrupt adjacent allocations in the shared udc_ep_pool, causing memory corruption and denial of service of the USB stack.

Affected Products

Zephyr RTOS builds using the device_next USB stack with the CDC NCM class enabled
Firmware images linking subsys/usb/device_next/class/usbd_cdc_ncm.c
Production builds where __ASSERT_NO_MSG bounds checks are compiled out

Discovery Timeline

2026-08-11 - CVE-2026-12052 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-12052

Vulnerability Analysis

The handler usbd_cdc_ncm_cth builds two fixed-size class responses: a 28-byte struct ntb_parameters for GET_NTB_PARAMETERS and an 8-byte struct ntb_input_size for GET_NTB_INPUT_SIZE. Both responses are copied into the control DATA IN buffer using net_buf_add_mem(buf, ..., sizeof(...)). The copy length is fixed at the structure size and does not honor setup->wLength from the USB SETUP packet.

The control DATA IN buffer is allocated with a capacity of exactly wLength bytes by usbd_ep_ctrl_data_in_alloc calling udc_ctrl_data_alloc and then net_buf_alloc_len(&udc_ep_pool, wLength). No round-up is applied on the IN endpoint. When wLength is less than the response structure size, the resulting memcpy writes past the end of the allocation. The overflow is bounded to 27 bytes for GET_NTB_PARAMETERS and 7 bytes for GET_NTB_INPUT_SIZE, and the written bytes are fixed device constants. No data is read back, so no information disclosure occurs.

Root Cause

The net_buf_add_mem and net_buf_simple_add helpers rely on __ASSERT_NO_MSG to bound the copy. Production builds compile the assertion out, leaving the copy length unchecked at runtime. The handler never clamps the response to the host-requested wLength, unlike the equivalent CDC ACM handler which already applies the clamp.

Attack Vector

The attacker connects a malicious USB host or interposer to the Zephyr device and issues a standard CDC NCM control transfer with wLength = 1. Enumeration is sufficient; no authentication or prior interaction with the device is required. The out-of-bounds write corrupts adjacent allocations and metadata inside the shared udc_ep_pool, resulting in USB stack denial of service.

// Patch: respect wLength in the CDC NCM to-host control handler
			.wNdbOutAlignment = sys_cpu_to_le16(CDC_NCM_ALIGNMENT),
			.wNtbOutMaxDatagrams = sys_cpu_to_le16(CDC_NCM_RECV_MAX_DATAGRAMS_PER_NTB),
		};
+		const uint16_t len = MIN(sizeof(ntb_params), setup->wLength);

		LOG_DBG("GET_NTB_PARAMETERS");
-		net_buf_add_mem(buf, &ntb_params, sizeof(ntb_params));
+		net_buf_add_mem(buf, &ntb_params, len);
		break;
	}

Source: Zephyr Commit c49b758

Detection Methods for CVE-2026-12052

Indicators of Compromise

USB SETUP packets carrying bRequest = GET_NTB_PARAMETERS (0x80) or GET_NTB_INPUT_SIZE (0x81) with a wLength smaller than 28 or 8 bytes respectively
Unexpected crashes or resets in the Zephyr USB device stack shortly after enumeration by an unknown host
Corruption of adjacent udc_ep_pool allocations observed in device logs or fault dumps

Detection Strategies

Instrument usbd_cdc_ncm_cth in debug builds so __ASSERT_NO_MSG remains active and catches undersized responses
Capture USB traffic with a hardware analyzer and alert on CDC NCM class control requests with anomalously small wLength values
Add runtime telemetry to net_buf_add_mem calls in the CDC NCM handler to record wLength against sizeof(struct ntb_parameters)

Monitoring Recommendations

Track firmware crash counters and USB stack fault handlers across fleet devices for anomalies after untrusted USB connections
Log the bmRequestType, bRequest, and wLength fields of every CDC NCM class control request during development and validation
Correlate device resets with USB enumeration events on shared or physically exposed ports

How to Mitigate CVE-2026-12052

Immediate Actions Required

Rebuild affected firmware with the upstream patch from Zephyr commit c49b758d87914e185ff611e93473bf8ec84a378a
Restrict physical access to devices running vulnerable Zephyr images with the CDC NCM class enabled
Disable the CDC NCM class in device configurations that do not require it until patched firmware is deployed

Patch Information

The fix clamps the response length to MIN(sizeof(...), setup->wLength) inside usbd_cdc_ncm_cth, matching the existing CDC ACM handler behavior. See the Zephyr Security Advisory GHSA-vr4p-6rg5-qgpx and the Zephyr Patch Commit for details.

Workarounds

Remove the CDC NCM class from the USB device configuration if networking over USB is not required
Deploy devices behind physical enclosures or port controls to block untrusted USB hosts
Apply a local patch mirroring the upstream MIN(sizeof(...), setup->wLength) clamp for both GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE handlers

bash

# Apply the upstream fix to a local Zephyr checkout
git fetch origin
git cherry-pick c49b758d87914e185ff611e93473bf8ec84a378a
west build -b <board> -p auto samples/subsys/usb/cdc_ncm