{"id":"CVE-2026-90587","published":"2026-11-09T22:18:56.970","lastModified":"2026-11-09T22:18:57.087","description":"usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor read, so the function returns success while having skipped usbh_device_set_configuration() — the only place udev->cfg_desc is allocated. The device structure is zero-initialised by usbh_device_alloc(), so udev->cfg_desc remains NULL.\n\nusbh_device_connect() treats the zero return as a successful enumeration and calls usbh_class_probe_device(), which starts its descriptor walk from udev->cfg_desc. usbh_desc_get_next_function() passes that NULL pointer to usbh_desc_is_valid(), whose only guard compares the caller-supplied size, so head->bLength is read through a NULL pointer.\n\nThe condition is triggered entirely by the attached peripheral: attaching a USB device (or any USB gadget emulating one) that reports bNumConfigurations = 0 reaches the defect directly from the UHC_EVT_DEV_CONNECTED_FS/_HS event handler in subsys/usb/host/usbh_core.c, with no authentication and no user interaction beyond the physical attachment.\n\nOn targets where page zero is unmapped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled this raises a fatal exception in the USB host thread, denying service to the host. Where address zero is readable, the descriptor walker instead parses low memory as a descriptor chain and can dispatch a class probe() with attacker-influenced values, causing further out-of-bounds reads through the still-NULL udev->cfg_desc in usbh_desc_get_iface(). No attacker-controlled write was identified, so the impact is availability plus a bounded out-of-bounds read. Note that CONFIG_USB_HOST_STACK is marked experimental.","cvssScore":4.6,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-476"],"vendors":[],"products":[],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/04e4284b4c3d3cd41791d44d7c39361e268b4d02","tags":[]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9pxv-6992-2g24","tags":[]}],"exploitRefs":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/04e4284b4c3d3cd41791d44d7c39361e268b4d02","tags":[]},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9pxv-6992-2g24","tags":[]}],"hasPoc":true,"ai":null}