{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "defaultStatus": "unaffected",
          "packageName": "zephyr",
          "product": "zephyr",
          "programFiles": [
            "subsys/usb/host/usbh_class.c",
            "subsys/usb/host/usbh_desc.c",
            "subsys/usb/host/usbh_device.c"
          ],
          "programRoutines": [
            {
              "name": "usbh_class_probe_device"
            },
            {
              "name": "usbh_desc_get_next_function"
            },
            {
              "name": "usbh_device_init"
            }
          ],
          "vendor": "zephyrproject",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor read, so the function returns success while having skipped usbh_device_set_configuration() \u2014 the only place udev-\u003ecfg_desc is allocated. The device structure is zero-initialised by usbh_device_alloc(), so udev-\u003ecfg_desc remains NULL.\n\nusbh_device_connect() treats the zero return as a successful enumeration and calls usbh_class_probe_device(), which starts its descriptor walk from udev-\u003ecfg_desc. usbh_desc_get_next_function() passes that NULL pointer to usbh_desc_is_valid(), whose only guard compares the caller-supplied size, so head-\u003ebLength is read through a NULL pointer.\n\nThe condition is triggered entirely by the attached peripheral: attaching a USB device (or any USB gadget emulating one) that reports bNumConfigurations = 0 reaches the defect directly from the UHC_EVT_DEV_CONNECTED_FS/_HS event handler in subsys/usb/host/usbh_core.c, with no authentication and no user interaction beyond the physical attachment.\n\nOn targets where page zero is unmapped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION is enabled this raises a fatal exception in the USB host thread, denying service to the host. Where address zero is readable, the descriptor walker instead parses low memory as a descriptor chain and can dispatch a class probe() with attacker-influenced values, causing further out-of-bounds reads through the still-NULL udev-\u003ecfg_desc in usbh_desc_get_iface(). No attacker-controlled write was identified, so the impact is availability plus a bounded out-of-bounds read. Note that CONFIG_USB_HOST_STACK is marked experimental."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "memory-safety",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T22:03:59.315Z",
        "orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
        "shortName": "zephyr"
      },
      "references": [
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/zephyrproject-rtos/zephyr/commit/04e4284b4c3d3cd41791d44d7c39361e268b4d02"
        },
        {
          "name": "GHSA-9pxv-6992-2g24",
          "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-9pxv-6992-2g24"
        }
      ],
      "title": "NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
    "assignerShortName": "zephyr",
    "cveId": "CVE-2026-90587",
    "datePublished": "2026-11-09T22:03:59.315Z",
    "dateReserved": "2026-09-12T18:04:39.470Z",
    "dateUpdated": "2026-11-09T22:03:59.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}