CVE-2026-90587

usbh device init() in subsys/usb/host/usbh device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor read, so the function returns success while having skipped usbh device set configuration() — the only place udev->cfg desc is allocated. The device structure is zero-initialised by usbh device alloc(), so udev->cfg desc remains NULL.

usbh device connect() treats the zero return as a successful enumeration and calls usbh class probe device(), which starts its descriptor walk from udev->cfg desc. usbh desc get next function() passes that NULL pointer to usbh desc is valid(), whose only guard compares the caller-supplied size, so head->bLength is read through a NULL pointer.

The condition is triggered entirely by the attached peripheral: attaching a USB device (or any USB gadget emulating one) that reports bNumConfigurations = 0 reaches the defect directly from the UHC EVT DEV CONNECTED FS/ HS event handler in subsys/usb/host/usbh core.c, with no authentication and no user interaction beyond the physical attachment.

On targets where page zero is unmapped or CONFIG NULL POINTER EXCEPTION DETECTION is enabled this raises a fatal exception in the USB host thread, denying service to the host. Where address zero is readable, the descriptor walker instead parses low memory as a descriptor chain and can dispatch a class probe() with attacker-influenced values, causing further out-of-bounds reads through the still-NULL udev->cfg desc in usbh desc get iface(). No attacker-controlled write was identified, so the impact is availability plus a bounded out-of-bounds read. Note that CONFIG USB HOST STACK is marked experimental.