CVE-2026-90587

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

EUVD-2026-120488

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

CVE-2026-90587

The Zephyr USB host stack contains a NULL pointer dereference vulnerability in usbh_device_init() located in subsys/usb/host/usbh_device.c. The root cause is that the function fails to set an error code when a device reports bNumConfigurations == 0, causing it to return success without allocating...

PT-2026-141163

usbh device init in subsys/usb/host/usbh device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

CVE-2026-90587: zephyrproject zephyr: usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises…

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

CVE-2026-17050

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...