CVE-2026-16147

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-16147
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16147.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-16147
Aliases
  • GHSA-3q4g-7w6j-8qfp
Published
2026-09-14T19:33:46Z
Modified
2026-09-16T08:11:32Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption
Details

The ITE IT82xx2 USB device-controller driver (drivers/usb/udc/udc_it82xx2.c) mishandles multi-packet OUT transfers on non-control endpoints. In work_handler_out() the active transfer buffer is obtained with udc_buf_peek() (which does not dequeue it); when a full max-packet-size packet arrives but the buffer still has tailroom (the transfer is not yet complete), the pre-fix code both re-arms the endpoint to keep filling that same buf via work_handler_xfer_continue() and simultaneously hands the same, still-being-filled buffer to the upper stack with udc_submit_ep_event().

Because udc_submit_ep_event() transfers ownership of the buffer to the USB device stack (usbd_event_carrier() appends &buf->node to uds_ctx->ep_events, after which the class handler processes and net_buf_unref()s it), the driver continues to DMA subsequent host-controlled OUT packets into a buffer the upper stack may already have freed and recycled — a use-after-free write. In addition, since the buffer was never dequeued, the completing packet runs udc_buf_get() on the same object and submits it a second time, appending &buf->node to the event slist twice (singly-linked-list corruption) and causing a double net_buf_unref().

The IT82xx2 is a USB peripheral controller, so the untrusted USB host controls OUT-transfer packetization and can force this path against any non-control OUT endpoint whose queued buffer exceeds one packet — an ordinary bulk/interrupt pattern. The driver and USB device stack run in kernel context above the external host, giving the host a device-side kernel heap-corruption primitive: a reliable denial of service and, because the written bytes are attacker-controlled, plausible corruption of adjacent net_buf pool memory. The vector is physical (USB attach). The fix defers submission until the buffer is completely filled and lets xfer_work_handler() drive continuation, so each OUT buffer is submitted to the upper stack exactly once.

Database specific 
{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16147.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
8469084dfae85f854555f0607f2c838dad097235
Fixed
2abc3088a6598579cf322452801a13cb0ec57b0e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v4.*
v4.0.0
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16147.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "12125386979472309379798286388642069399",
                "207971871462529193278615892091127564230",
                "194357954378223163382760803190051169869",
                "295585250151270789414232924232240701611",
                "45822738393162265795200428207025920685",
                "86762797250656652759540616495303576575",
                "279421963446760025268763090989366925118",
                "293190200979269846343991011352208399115",
                "203680588969725284050000814824821980784",
                "127463751975615761349823005076784652305",
                "154004680630889207128635226469211020756",
                "120913739522465049027866654043591848327",
                "192535268168543216928539944784187088997",
                "321218821454852484305037562013210346610",
                "263725827319924201207095300090643060546",
                "250289795763205383403015326007018897965"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-16147-1debc731",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/2abc3088a6598579cf322452801a13cb0ec57b0e",
        "target": {
            "file": "drivers/usb/udc/udc_it82xx2.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "161218539846615165078001151377400524737",
            "length": 1591
        },
        "id": "CVE-2026-16147-aa708424",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/2abc3088a6598579cf322452801a13cb0ec57b0e",
        "target": {
            "file": "drivers/usb/udc/udc_it82xx2.c",
            "function": "work_handler_out"
        }
    }
]
vanir_signatures_modified 
"2026-09-16T08:11:32Z"