CVE-2026-12051

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The USB DFU class implementation in the experimental device next USB device stack contains a NULL pointer dereference within the handle download() function. This occurs when the handler processes a DFU DNLOAD request via the USB control endpoint that lacks a Data OUT stage, such as the zero-length terminating download used to end firmware transfers. In this scenario, the USB core invokes the class handler with a NULL buffer, and the function attempts to access buf->len and buf->data without verifying if the buf net buf pointer is non-NULL. This leads to a NULL+offset read, triggering a fatal CPU fault and resulting in a denial of service through a device crash or reset. This issue requires DFU download support to be enabled with a registered image and can be triggered by a malicious USB host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.