AIKIDO-2026-364175
zephyrproject-rtos.zephyr is vulnerable to Denial of Service (DoS)
46
CVE Score
Medium
Denial of Service (DoS)
TL;DR
handle_download() in the experimental device_next USB DFU class (subsys/usb/device_next/class/usbd_dfu.c) computes MIN(setup->wLength, buf->len) and passes buf->data to the image write callback without checking that buf is non-NULL. A USB host that completes a download with a zero-length DFU_DNLOAD (no Data OUT stage) reaches the handler with a NULL buffer after the device is in DFU_DNLOAD_IDLE, causing a NULL+offset read and a fatal CPU fault. The fix guards the buffer access so a zero-length, NULL-data transfer is passed to the callback instead of crashing.
How do I fix this?
Upgrade the zephyrproject-rtos.zephyr library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and enable USB DFU download support in the experimental device_next USB device stack with a registered image.
Package
zephyrproject-rtos.zephyrVersions
4.4.0 - 4.4.1
Fixed in 4.4.2Background info
zephyrproject-rtos.zephyr is vulnerable to Denial of Service (DoS) in versions 4.4.0 - 4.4.1.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.