CVE-2026-10668

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10668
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10668.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10668
Aliases
  • GHSA-rm28-x84j-4qrx
Published
2026-07-12T16:16:51Z
Modified
2026-10-28T11:04:04Z
Severity
  • 2.4 (Low) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver
Details

The Nuvoton NuMaker HSUSBD USB device-controller driver (drivers/usb/udc/udc_numaker.c) armed the control Data IN stage unconditionally (base->CEPTXCNT = len in numaker_hsusbd_ep_trigger). Because the HSUSBD hardware cannot disarm a control Data IN already armed for a previous transfer, a USB host that cancels an in-flight control transfer (timeout) and then issues a new SETUP packet can drive the driver out of sync: stale data may be transmitted in the new transfer and the control endpoint can become permanently stuck NAK'ing every subsequent control transfer.

A malicious or buggy host (physical/adjacent attacker driving the bus) can repeatedly cancel-and-re-SETUP to wedge the device's USB control endpoint, denying service to the device's USB function (the device stops enumerating/responding on the control pipe) until a USB reset or re-plug. The flaw is an availability-only denial of service; the FIFO copy loops (bounded by net_buf length and the hardware BUFFULL flag) and the net_buf lifecycle are independent of the arming desync, so there is no out-of-bounds access, use-after-free, or information leak.

The fix monitors the IN-token and new-SETUP events (k_event) and only arms control Data IN when an IN token is present and no new SETUP has arrived, cancelling the current transfer on a new SETUP. Affects boards using the Nuvoton NuMaker HSUSBD controller (CONFIG_UDC_NUMAKER with DT_HAS_NUVOTON_NUMAKER_HSUSBD_ENABLED); shipped in v4.4.0.

Database specific 
{
    "cna_assigner":  "zephyr",
    "cwe_ids":  [
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10668.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
684c9e8f32e4373a21098559f748f06915f950c9
Fixed
dccb09599635bdff17633fa7e9dab014b91dce90
Fixed
48e003326873e8bbc0ee4b67334e0dd8b5fb890f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "4.4.0"
                },
                {
                    "fixed":  "4.4.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "48e003326873e8bbc0ee4b67334e0dd8b5fb890f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v4.*
v4.4.0
v4.4.1
v4.4.1-rc1
v4.4.2-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10668.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "294802644622432222452728181771543973167",
            "length":  417
        },
        "id":  "CVE-2026-10668-01649bdf",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f",
        "target":  {
            "file":  "drivers/usb/udc/udc_numaker.c",
            "function":  "numaker_usbd_setup_th"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "199899498820452951872873387320316611133",
            "length":  881
        },
        "id":  "CVE-2026-10668-18dc4cc9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f",
        "target":  {
            "file":  "drivers/usb/udc/udc_numaker.c",
            "function":  "numaker_usbd_ep_th"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "212239203639149397585444336114230354849",
            "length":  988
        },
        "id":  "CVE-2026-10668-35e18c17",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f",
        "target":  {
            "file":  "drivers/usb/udc/udc_numaker.c",
            "function":  "numaker_hsusbd_cep_th"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "200302612166562255512535830461200523904",
            "length":  1059
        },
        "id":  "CVE-2026-10668-5aadf54b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f",
        "target":  {
            "file":  "drivers/usb/udc/udc_numaker.c",
            "function":  "numaker_usbd_msg_handle_setup"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "259217130851666443345745807267609963692",
            "length":  1247
        },
        "id":  "CVE-2026-10668-b71aa87a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f",
        "target":  {
            "file":  "drivers/usb/udc/udc_numaker.c",
            "function":  "numaker_hsusbd_ep_trigger"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "209744177636148665427396135275240675048",
            "length":  1955
        },
        "id":  "CVE-2026-10668-c961525b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f",
        "target":  {
            "file":  "drivers/usb/udc/udc_numaker.c",
            "function":  "udc_numaker_driver_preinit"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "241389319298828758155412359237575490051",
                "267055904774983317349638728921346387007",
                "40138118548230778008255266612941667642",
                "275046065276559897256636072759879234282",
                "32530242017450250541540051939140552967",
                "255380828010655616339518745637221977379",
                "100492035784340582716280462175624235590",
                "114285645307682133736964390271327749067",
                "109317845498026655607785193763121894604",
                "104988587042474614407231295697768313182",
                "225871503410594470815271421288829065707",
                "11669908138967421139441558434838288220",
                "328974649846732901683815576787432944827",
                "307577814714316669172416844609646604764",
                "338215714557520052180863809928365858225",
                "226925310355881346695537275873931970122",
                "164478775703085564434164384213117022061",
                "138263951981620687572486744864866758439",
                "175697311187174933202758335604804890097",
                "93237164439815077592996162089381459882",
                "71392853754803693621778314366652141811",
                "64304858125680409711860857753408069677",
                "187893672326624475372276793853607560312",
                "125901265339356648589673505474386623907",
                "6491507777104203554669675076412710217",
                "185167210619691597433800290998027245749",
                "173925807139309266035499105364069310157",
                "276202176694071034195555892590857491727",
                "176184562291609012968977574243477787223",
                "207865259613439440994404301686130648875",
                "145913377304301723931421822172469869901",
                "189457131755699308990406145829866357216",
                "115815126631472291737657172055085405327",
                "258879464636268114514269906129079757646",
                "236782500404038691611201929168572570803",
                "169518978909707772120578658196004662577",
                "338215714557520052180863809928365858225",
                "38374748597581438494344525832808826267",
                "239961554600311872959603801992881262200",
                "8652640204482289202764827715566003162",
                "284030959744367045918304269475110674105",
                "81436964055058554113419113157641829042",
                "266037353660085666874869413416003724426",
                "172225370413054222648542128688239257973",
                "185705523847884662306044097758801483813",
                "329735100072484430486884419840467291800",
                "85751920025150946971692036704924096403",
                "272977260060252353713746571484769882557",
                "64400482636567351965778678002229580463",
                "156758402341057987987580195257074515486",
                "40176666044894879608797774476589546686",
                "273643278986455083148215799693680925472",
                "246859851977276712200208529344209379762"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-10668-cecf480b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/48e003326873e8bbc0ee4b67334e0dd8b5fb890f",
        "target":  {
            "file":  "drivers/usb/udc/udc_numaker.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:04:04Z"