CVE-2026-16148 Overview
CVE-2026-16148 affects the ITE it82xx2 USB device-controller driver in the Zephyr RTOS. The driver reinitializes an in-use delayable work item during a disable-then-enable cycle, corrupting kernel timeout and workqueue linked lists. A physically connected USB host can trigger repeated udc_disable()/udc_enable() transitions using tools like dfu-util --detach, forcing a kernel panic. The vulnerability is classified under [CWE-666] (Operation on Resource in Wrong Phase of Lifetime). The result is an unauthenticated denial of service reachable across the USB boundary from a removable host.
Critical Impact
An attacker with physical USB access can force a kernel panic on Zephyr devices using the it82xx2 USB device controller by driving repeated attach/reset/re-enumeration cycles.
Affected Products
- Zephyr RTOS — drivers/usb/udc/udc_it82xx2.c
- Devices using the ITE it82xx2 USB device-controller driver
- Zephyr project builds prior to commit 350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c
Discovery Timeline
- 2026-09-14 - CVE-2026-16148 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-16148
Vulnerability Analysis
The it82xx2 USB device-controller driver initializes its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) inside it82xx2_enable(), the driver's .enable op. This work item is scheduled essentially continuously while the USB bus is active. The interrupt handler reschedules it on every SOF frame, and suspended_handler() reschedules itself. As a result, its timeout node is normally linked in the kernel timeout list or a workqueue pending queue.
A normal disable-then-enable cycle re-runs api->enable() because udc_enable() only rejects a redundant enable, not a re-enable after disable. This reinitializes the still-pending work in place, corrupting the kernel timeout and workqueue linked lists.
Root Cause
k_work_init_delayable() in kernel/work.c unconditionally overwrites the entire k_work_delayable structure, including its timeout and queue linkage, with no busy check. Because it82xx2_disable() does not cancel the work, calling k_work_init_delayable() on an already-queued item detaches it from kernel-managed lists without unlinking. Subsequent list operations dereference stale pointers and panic the kernel.
Attack Vector
An external USB host controls the disable/enable and suspend/resume timing across the USB boundary. A host performing USB DFU detach via dfu-util --detach or forcing repeated attach, reset, and re-enumeration drives the udc_disable()/udc_enable() transitions. The attacker arranges for the suspend work to be pending across a re-enable, triggering the corruption. No authentication is required, but physical USB connectivity to the target is mandatory.
// Patch: move k_work_init_delayable() out of .enable op into one-time preinit
struct it82xx2_data *priv = udc_get_private(dev);
k_sem_init(&priv->suspended_sem, 0, 1);
- k_work_init_delayable(&priv->suspended_work, suspended_handler);
atomic_clear_bit(&priv->out_fifo_state, IT82xx2_STATE_OUT_SHARED_FIFO_BUSY);
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c
The fix moves k_work_init_delayable() into the one-time preinit function so the work is initialized exactly once, eliminating the re-initialization of an in-use item.
Detection Methods for CVE-2026-16148
Indicators of Compromise
- Unexpected kernel panics on Zephyr devices coincident with USB re-enumeration or DFU activity.
- Crash dumps referencing k_work_delayable, suspended_handler, or kernel timeout list functions.
- Repeated udc_disable()/udc_enable() transitions logged around the time of failure.
Detection Strategies
- Review Zephyr build manifests to identify devices compiled with the it82xx2 USB device-controller driver.
- Correlate device reboot telemetry with USB attach/detach events from adjacent host systems.
- Instrument development and QA builds with fault handlers that capture work-item state on panic.
Monitoring Recommendations
- Track physical USB port activity on deployed embedded devices, particularly unexpected DFU detach commands.
- Alert on repeated device resets within short intervals, which may indicate exploitation attempts.
- Aggregate device crash logs into a centralized platform for correlation across fleets.
How to Mitigate CVE-2026-16148
Immediate Actions Required
- Apply the upstream Zephyr patch that moves k_work_init_delayable() into the one-time preinit function.
- Rebuild and redeploy firmware for all devices using the it82xx2 USB device controller.
- Restrict physical access to USB ports on affected devices where feasible.
Patch Information
The fix is available in Zephyr commit 350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c. See the GitHub Security Advisory GHSA-fvp9-j2pq-477x for the full advisory. The patch relocates the delayable work initialization from it82xx2_enable() into the driver's preinit path so the work object is constructed exactly once.
Workarounds
- Physically block or disable exposed USB device ports on affected hardware until firmware can be updated.
- Deploy tamper-evident enclosures on devices in environments where physical access cannot be fully controlled.
- For custom driver forks, cancel priv->suspended_work in it82xx2_disable() before allowing a subsequent enable.
# Fetch and apply the upstream fix in a Zephyr workspace
cd zephyr
git fetch origin
git cherry-pick 350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c
west build -b <your_board> <your_app> --pristine
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
