{"id":"CVE-2026-10647","aliases":[],"cve":{"records":[{"id":"CVE-2026-10647","source":"zephyr","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-02T15:11:50.331Z","published":"2026-06-29T21:39:08.442Z","modified":"2026-11-04T04:58:19.895Z"}],"publishers":[{"name":"zephyr","role":"CNA","organizationId":"e2e69745-5e70-4e92-8431-deb5529a81ad","modified":"2026-11-04T04:58:19.895Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-06-30T13:33:34.044Z"}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/255bccc1badd1aa06c6e5ddf5b40de8463b33f02","tags":["patch"],"source":"zephyr"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xcf7-r86m-5q9f","tags":[],"source":"zephyr"}],"weaknesses":[{"id":"CWE-833","description":"dos","source":"zephyr"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-06-30T13:33:24.759453Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure","titleSource":"zephyr","descriptionSource":"zephyr","description":"The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send(). When the enqueue fails, the function still calls k_sem_take(&data->sync_sem, K_FOREVER), blocking on a completion semaphore that is only ever signaled from the bulk-IN transfer-completion callback. Because nothing was enqueued, that callback never fires and the calling thread — a shared network traffic-class TX thread — deadlocks permanently while holding the interface TX lock, halting transmission until reboot (and leaking the transmit buffer).\n\nThe enqueue fails under conditions controlled by the attached USB host: usbd_ep_enqueue() returns -EPERM whenever the bus is suspended (a standard, persistent host operation), and the underlying udc_ep_enqueue() returns -EPERM/-ENODEV on disconnect, bus reset, or endpoint disable. The cdc_ncm_send() guard only checks the DATA_IFACE_ENABLED and IFACE_UP flags, not the suspended state, so a packet transmitted while the host holds the bus suspended reaches the failing enqueue and deadlocks the TX path.\n\nThe realistic trigger is a bus suspend that occurs while the exported network interface is active and has traffic to send — host sleep, USB selective/auto-suspend, or hub power management — after which any device-originated packet deadlocks the path, recoverable only by reboot. The impact is a persistent loss of the virtual network connection between the host's NCM interface and the Zephyr device; because the deadlocked thread is a shared traffic-class TX thread, egress on other network interfaces can stall as well. There is no memory corruption or information disclosure.\n\nThe defect was introduced with the CDC-NCM driver and shipped in releases through v4.4.0; it is fixed by checking the usbd_ep_enqueue() return value and freeing the buffer before the blocking wait.","score":5.3,"severity":"medium","published":"2026-06-29T21:39:08.442Z","modified":"2026-11-04T04:58:19.895Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"zephyrproject","name":"zephyr","platforms":[],"versions":[{"version":"4.0.0","status":"affected","lessThan":"4.3.1","versionType":"semver"},{"version":"4.4.0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"zephyr","url":"https://www.cve.org/CVERecord?id=CVE-2026-10647"}],"remediation":[],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/255bccc1badd1aa06c6e5ddf5b40de8463b33f02","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xcf7-r86m-5q9f"],"sources":[{"name":"CVE","id":"CVE-2026-10647","modified":"2026-11-04T04:58:19.895Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-10647"}],"assessments":[{"source":"zephyr","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-04T05:06:13.454Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:30:30.969Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-04T09:20:31.176Z","attemptedAt":"2026-11-04T09:20:31.176Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-04T09:20:32.318Z","attemptedAt":"2026-11-04T09:20:32.318Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-04T09:20:32.318Z","attemptedAt":"2026-11-04T09:20:32.318Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-04T09:20:32.318Z","attemptedAt":"2026-11-04T09:20:32.318Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-10647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10647","modified":"2026-10-25T21:10:00.770","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-04T09:20:31.176Z"},{"source":"ENISA EUVD","id":"EUVD-2026-40235","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40235","modified":"Nov 4, 2026, 4:58:19 AM","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-04T09:20:32.318Z"},{"source":"FIRST EPSS","id":"CVE-2026-10647","url":"https://www.first.org/epss/","probability":0.00201,"percentile":0.10033,"date":"2026-11-03","checkedAt":"2026-11-04T09:20:32.318Z"}],"aiSummary":{"text":"A deadlock denial of service vulnerability in Zephyr's USB CDC-NCM device class affects versions 4.0.0 through 4.4.0. It occurs when the enqueue fails, causing the thread to block permanently. The impact is a persistent loss of the virtual network connection.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T05:46:06.001Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-10647"}]}}