CVE-2026-10656

Name of the Vulnerable Software and Affected Versions Zephyr version 4.4.0

Description The MAX32xxx USB device controller driver (drivers/usb/udc/udc max32.c, compatible adi max32 usbhs) contains a flaw where it dereferences an endpoint buffer in its OUT and IN transfer-completion handlers without verifying if the buffer is NULL. Specifically, the udc event xfer out done() function calls net buf add(buf, ep request->actlen) immediately after buf = udc buf get(ep cfg), but udc buf get() can return NULL if the endpoint FIFO is empty. This occurs because a transfer-completion event is processed asynchronously; if a USB host aborts an in-flight EP0 control transfer with a new SETUP packet, the endpoint FIFO may be drained before the event is processed. This leads to a near-NULL pointer dereference, resulting in a device crash and denial of service. This issue can be triggered by a USB host with physical bus access and requires no authentication.

Recommendations Update Zephyr to a version containing the fix that implements NULL-buffer checks in both the OUT-done and IN-done handlers to return early with UDC EVT ERROR/-ENOBUFS.