CVE-2026-10647 zephyrproject CVE debrief

Who should care

Users of the Zephyr project's USB CDC-NCM device class implementation, particularly those using versions through v4.4.0, should be aware of this vulnerability and take steps to apply the patch or mitigate the risk.

Technical summary

The USB CDC-NCM device class implementation in the Zephyr project contains a deadlock vulnerability. When the `usbd_ep_enqueue()` function fails, the `cdc_ncm_send()` function still calls `k_sem_take(&data->sync_sem, K_FOREVER)`, blocking on a completion semaphore. This can occur when the bus is suspended or disconnected, causing a permanent deadlock in the TX path and halting transmission until reboot.

Defensive priority

Medium priority due to potential for denial of service

Recommended defensive actions

• Apply the patch from https://github.com/zephyrproject-rtos/zephyr/commit/255bccc1badd1aa06c6e5ddf5b40de8463b33f02
• Review and apply vendor advisory from https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xcf7-r86m-5q9f
• Monitor for and apply future security updates from the Zephyr project
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was introduced in the CDC-NCM driver and shipped in releases through v4.4.0. It is fixed by checking the `usbd_ep_enqueue()` return value and freeing the buffer before the blocking wait. A bus suspend that occurs while the exported network interface is active and has traffic to send can trigger the deadlock. The impact is a persistent loss of the virtual network connection between the host's NCM interface and the Zephyr device. There is no memory corruption or information disclosure. Users should verify their deployments and apply patches or mitigations accordingly.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.