CVE-2026-16148

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-16148
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16148.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-16148
Aliases
  • GHSA-fvp9-j2pq-477x
Published
2026-09-14T19:33:47Z
Modified
2026-09-16T08:29:33Z
Severity
  • 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item
Details

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) inside it82xx2_enable() (the driver's .enable op) in drivers/usb/udc/udc_it82xx2.c. This work item is scheduled essentially continuously while the USB bus is active: the interrupt handler reschedules it on every SOF frame and suspended_handler() reschedules itself, so its timeout node is normally linked in the kernel timeout list / a workqueue pending queue.

k_work_init_delayable() (kernel/work.c) unconditionally overwrites the entire k_work_delayable structure, including its timeout and queue linkage, with no busy check. Because it82xx2_disable() does not cancel the work, a normal disable-then-enable cycle re-runs api->enable() (udc_enable() only rejects a redundant enable, not a re-enable after disable) and re-initializes the still-pending work in place, corrupting the kernel timeout/workqueue linked lists and causing a kernel panic.

An external USB host — for example a host performing USB DFU detach (dfu-util --detach) or forcing repeated attach/reset/re-enumeration — drives the udc_disable()/udc_enable() transitions and controls suspend/resume timing, so it can arrange for the suspend work to be pending across a re-enable. This yields an unauthenticated denial of service (kernel panic) reachable across the USB boundary from a removable, physically-connected host, with no confidentiality or integrity impact demonstrated.

The fix moves the k_work_init_delayable() call into the one-time preinit function so the work is initialized exactly once, eliminating the re-initialization of an in-use item.

Database specific 
{
    "cna_assigner": "zephyr",
    "cwe_ids": [
        "CWE-666"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16148.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
36940db938a8f4a1e919496793ed439850a221c2
Fixed
350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.7.0"
        },
        {
            "fixed": "4.4.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.7.0
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.4.0
v4.4.0-rc1
v4.4.0-rc2
v4.4.0-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16148.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "221150625420740132896610759453073453409",
            "length": 1861
        },
        "id": "CVE-2026-16148-02302178",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c",
        "target": {
            "file": "drivers/usb/udc/udc_it82xx2.c",
            "function": "it82xx2_usb_driver_preinit"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "336320293347757465951711119569174275306",
                "294176960162537548848804946660367886429",
                "176884664821113168725733313667093488234",
                "258954051390995391521960179519719801253",
                "149699298505737454150520071671018319363",
                "217871377414437552124220390156733391650",
                "8218237362883327511410411849146969821"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-16148-b9433931",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c",
        "target": {
            "file": "drivers/usb/udc/udc_it82xx2.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "68994605172123279235980028945010805941",
            "length": 688
        },
        "id": "CVE-2026-16148-d4a35621",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c",
        "target": {
            "file": "drivers/usb/udc/udc_it82xx2.c",
            "function": "it82xx2_enable"
        }
    }
]
vanir_signatures_modified 
"2026-09-16T08:29:33Z"