Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
zephyrproject zephyr — Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure
AV AC PR UI S C I A CVSS EPSS %ile KEV
A H N N U N N H 5.3 .0021 11.1 —
AFFECTED
Product Versions Fixed
zephyr 4.0.0 – —
TIMELINE
Jun 2 Reserved by zephyr
Jun 29 EXPLOIT PUBLISHED — CVE-2026-10647 (zephyrproject zephyr). Public exploit reference added.
Jun 29 Published (CNA: zephyr)
Aug 6 EXPLOIT PUBLISHED — CVE-2026-10647 (zephyrproject zephyr). Public exploit reference added.
Description
The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send(). When the enqueue fails, the function still calls k_sem_take(&data->sync_sem, K_FOREVER), blocking on a completion semaphore that is only ever signaled from the bulk-IN transfer-completion callback. Because nothing was enqueued, that callback never fires and the calling thread — a shared network traffic-class TX thread — deadlocks permanently while holding the interface TX lock, halting transmission until reboot (and leaking the transmit buffer).
The enqueue fails under conditions controlled by the attached USB host: usbd_ep_enqueue() returns -EPERM whenever the bus is suspended (a standard, persistent host operation), and the underlying udc_ep_enqueue() returns -EPERM/-ENODEV on disconnect, bus reset, or endpoint disable. The cdc_ncm_send() guard only checks the DATA_IFACE_ENABLED and IFACE_UP flags, not the suspended state, so a packet transmitted while the host holds the bus suspended reaches the failing enqueue and deadlocks the TX path.
The realistic trigger is a bus suspend that occurs while the exported network interface is active and has traffic to send — host sleep, USB selective/auto-suspend, or hub power management — after which any device-originated packet deadlocks the path, recoverable only by reboot. The impact is a persistent loss of the virtual network connection between the host's NCM interface and the Zephyr device; because the deadlocked thread is a shared traffic-class TX thread, egress on other network interfaces can stall as well. There is no memory corruption or information disclosure.
The defect was introduced with the CDC-NCM driver and shipped in releases through v4.4.0; it is fixed by checking the usbd_ep_enqueue() return value and freeing the buffer before the blocking wait.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| June 2, 2026 | Reserved | Reserved by zephyr |
| June 29, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-10647 (zephyrproject zephyr). Public exploit reference added. |
| June 29, 2026 | Published | Published (CNA: zephyr) |
| August 6, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-10647 (zephyrproject zephyr). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| zephyrproject | zephyr | — | 4.0.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-10647 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.