CVE-2026-12052: Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response
The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS (28-byte struct ntbparameters) and GETNTBINPUTSIZE (8-byte struct ntbinputsize) class requests and copies the whole structure into the control DATA IN buffer with netbufaddmem(buf, ..., sizeof(...)), ignoring the host-supplied wLength.
The control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbdepctrldatainalloc -> udcctrldataalloc -> netbufalloclen(&udceppool, wLength); no round-up is applied for the IN endpoint). Because netbufaddmem/netbufsimpleadd only bounds the copy with an ASSERTNOMSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer.
The request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the devicenext USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udceppool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c so that for GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) it copies only MIN(sizeof(struct ntb_parameters/ntb_input_size), setup->wLength) bytes into the control DATA IN buffer (matching the CDC ACM handler), rather than always copying the full structure size.
Zephyr USB device stack - CDC NCM class control handler (usbd_cdc_ncm_cth) Clamp control response copy length to host wLength = Use MIN(sizeof(struct ntb_parameters/ntb_input_size), setup->wLength) instead of sizeof(...)