# CVE-2026-10647: Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure > A deadlock in the USB CDC-NCM driver causes permanent denial of service when a host suspends the bus during transmission, requiring a reboot to recover. - **Severity:** Medium 5.3 (`CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** No - **Published:** 29 Jun 2026 - **Updated:** 15 Oct 2026 - **Also known as:** GHSA-xcf7-r86m-5q9f ## What is CVE-2026-10647? CVE-2026-10647 is a medium-severity denial of service vulnerability in Zephyrproject Zephyr, published on 29 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send(). When the enqueue fails, the function still calls k_sem_take(&data->sync_sem, K_FOREVER), blocking on a completion semaphore that is only ever signaled from the bulk-IN transfer-completion callback. Because nothing was enqueued, that callback never fires and the calling thread — a shared network traffic-class TX thread — deadlocks permanently while holding the interface TX lock, halting transmission until reboot (and leaking the transmit buffer). The enqueue fails under conditions controlled by the attached USB host: usbd_ep_enqueue() returns -EPERM whenever the bus is suspended (a standard, persistent host operation), and the underlying udc_ep_enqueue() returns -EPERM/-ENODEV on disconnect, bus reset, or endpoint disable. The cdc_ncm_send() guard only checks the DATA_IFACE_ENABLED and IFACE_UP flags, not the suspended state, so a packet transmitted while the host holds the bus suspended reaches the failing enqueue and deadlocks the TX path. The realistic trigger is a bus suspend that occurs while the exported network interface is active and has traffic to send — host sleep, USB selective/auto-suspend, or hub power management — after which any device-originated packet deadlocks the path, recoverable only by reboot. The impact is a persistent loss of the virtual network connection between the host's NCM interface and the Zephyr device; because the deadlocked thread is a shared traffic-class TX thread, egress on other network interfaces can stall as well. There is no memory corruption or information disclosure. The defect was introduced with the CDC-NCM driver and shipped in releases through v4.4.0; it is fixed by checking the usbd_ep_enqueue() return value and freeing the buffer before the blocking wait. Weakness: CWE-667 (Improper Locking), CWE-833 (Deadlock) ## Which versions are affected by CVE-2026-10647? It affects 1 product. Products: Zephyrproject Zephyr. ## How do I fix CVE-2026-10647? No fix has been published for CVE-2026-10647 yet. Limit exposure of the affected software until one is available. ## Is CVE-2026-10647 being exploited? There is no known exploitation of CVE-2026-10647 in the wild and no public exploit code. ## Other vulnerabilities in Zephyrproject Zephyr - [CVE-2026-5067](https://insights.sbomify.com/CVE-2026-5067/): Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key (critical 9.8) - [CVE-2022-3806](https://insights.sbomify.com/CVE-2022-3806/): Bluetooth HCI Error Handling Double Free (critical 9.8) - [CVE-2017-14199](https://insights.sbomify.com/CVE-2017-14199/): Memory corruption in getaddrinfo (critical 9.8) - [CVE-2018-1000800](https://insights.sbomify.com/CVE-2018-1000800/): Null dereference in n/a (critical 9.8) - [CVE-2021-3329](https://insights.sbomify.com/CVE-2021-3329/): DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer (critical 9.6) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-10647 and fix it if it is affected. What it is: CVE-2026-10647 is a medium-severity denial of service vulnerability in Zephyrproject Zephyr, published on 29 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-10647 in the wild and no public exploit code. Affected product: Zephyrproject Zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-10647/ (Markdown: https://insights.sbomify.com/CVE-2026-10647/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-10647 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-10647 - OSV: https://osv.dev/vulnerability/CVE-2026-10647 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-10647/ Summaries are generated and may contain mistakes; the official description above is the record.