CVE-2026-16148 zephyrproject CVE debrief

Who should care

Defenders responsible for USB device handling and kernel configuration should assess exposure and prioritize patching. This includes reviewing system configurations, ensuring proper USB device handling, and monitoring for potential exploitation attempts. Additionally, defenders should verify and apply the patch, and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-16148 is a denial-of-service vulnerability in the ITE it82xx2 USB device-controller driver. Defenders should prioritize verifying and applying the patch, as well as monitoring for potential exploitation attempts. The vulnerability allows an external USB host to cause a kernel panic by driving udc_disable()/udc_enable() transitions and controlling suspend/resume timing.

• Denial-of-service vulnerability allows for kernel panic
• Unauthenticated exploitation possible across USB boundary
• No confidentiality or integrity impact demonstrated
• Patching required to prevent exploitation

Technical summary

The ITE it82xx2 USB device-controller driver has a vulnerability that allows an external USB host to cause a kernel panic. This is achieved by driving udc_disable()/udc_enable() transitions and controlling suspend/resume timing, resulting in the re-initialization of a pending work item and corruption of kernel timeout/workqueue linked lists. The vulnerability is caused by the re-initialization of a pending work item in the it82xx2_enable() function. Evidence from the CVE record and source references supports this conclusion. The fix moves the k_work_init_delayable() call into the one-time preinit function so the work is initialized exactly once, eliminating the re-initialization of an in-use item.

Defensive priority

Defenders should prioritize verifying and applying the patch, as well as monitoring for potential exploitation attempts.

Recommended defensive actions

• Verify and apply the patch to prevent exploitation
• Monitor for potential exploitation attempts
• Review system configurations and ensure proper USB device handling
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The vulnerability is caused by the re-initialization of a pending work item in the it82xx2_enable() function, which corrupts the kernel timeout/workqueue linked lists. Evidence from the CVE record and source references supports this conclusion.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.