CVE-2026-90587

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

CVE-2026-90587 NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

CVE-2026-90587 NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

EUVD-2026-120488

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...

CVE-2026-90587

The Zephyr USB host stack contains a NULL pointer dereference vulnerability in usbh_device_init() located in subsys/usb/host/usbh_device.c. The root cause is that the function fails to set an error code when a device reports bNumConfigurations == 0, causing it to return success without allocating...

CVE-2026-90587: zephyrproject zephyr: usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises…

usbhdeviceinit in subsys/usb/host/usbhdevice.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 from the preceding successful descriptor...