CVE-2026-10663

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.4.0 through 4.4.x

Description In the experimental USB host stack (CONFIG USB HOST STACK), the usbh device disconnect() function in subsys/usb/host/usbh device.c frees the root usb device slab object without clearing the cached pointer ctx->root. The bus removal handler dev removed handler() in subsys/usb/host/usbh core.c relies solely on ctx->root to determine what to tear down, checking only if it is non-NULL.

Because certain UHC controller drivers (such as uhc max3421e and uhc mcux common) synthesize UHC EVT DEV REMOVED directly from physical bus line state without debounce or state guards, an attacker with physical USB access can trigger a second device-removed event after a root device disconnect. This causes the handler to re-enter usbh device disconnect() using a dangling pointer, leading to a use-after-free when locking a mutex inside the freed object, and a double-free when calling k mem slab free() on the already-freed block. If the slab block was reissued to a new device, it results in memory corruption. This can lead to a denial of service (crash) and memory corruption.

Recommendations Update Zephyr to a version where ctx->root is cleared in usbh device disconnect() before the object is freed.