CVE-2026-16148

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) inside it82xx2_enable() (the driver's .enable op) in drivers/usb/udc/udc_it82xx2.c. This work item is scheduled essentially continuously while the USB bus is active: the interrupt handler reschedules it on every SOF frame and suspended_handler() reschedules itself, so its timeout node is normally linked in the kernel timeout list / a workqueue pending queue. k_work_init_delayable() (kernel/work.c) unconditionally overwrites the entire k_work_delayable structure, including its timeout and queue linkage, with no busy check. Because it82xx2_disable() does not cancel the work, a normal disable-then-enable cycle re-runs api->enable() (udc_enable() only rejects a redundant enable, not a re-enable after disable) and re-initializes the still-pending work in place, corrupting the kernel timeout/workqueue linked lists and causing a kernel panic. An external USB host — for example a host performing USB DFU detach (dfu-util --detach) or forcing repeated attach/reset/re-enumeration — drives the udc_disable()/udc_enable() transitions and controls suspend/resume timing, so it can arrange for the suspend work to be pending across a re-enable. This yields an unauthenticated denial of service (kernel panic) reachable across the USB boundary from a removable, physically-connected host, with no confidentiality or integrity impact demonstrated. The fix moves the k_work_init_delayable() call into the one-time preinit function so the work is initialized exactly once, eliminating the re-initialization of an in-use item.

• CWE-666

• https://github.com/zephyrproject-rtos/zephyr/commit/350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fvp9-j2pq-477x

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16142The TrueBooker plugin for WordPress is vulnerable to Account…9.8
• CVE-2026-16143The VikRentItems – Flexible Rental Management System plugin …7.2
• CVE-2026-16144The Kali Forms — Contact Form & Drag-and-Drop Builder plugin…8.1
• CVE-2026-16145The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative fo…7.2
• CVE-2026-16146The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative fo…4.9
• CVE-2026-16147The ITE IT82xx2 USB device-controller driver (drivers/usb/ud…6.8
• CVE-2026-16149The Security Hardener plugin for WordPress is vulnerable to …8.8
• CVE-2026-1615Versions of the package jsonpath before 1.3.0 are vulnerable…9.8
• CVE-2026-16150A vulnerability was found in RobinHerbots Inputmask up to 5.…6.3
• CVE-2026-16151A vulnerability has been found in CartoDB carto-api-client 0…6.3
• CVE-2026-16152A vulnerability was found in SourceCodester Class and Exam T…7.3
• CVE-2026-16154A vulnerability was determined in SourceCodester Class and E…7.3