---
id: CVE-2026-16148
title: >-
  The ITE it82xx2 USB device-controller driver initialized its bus-suspend
  detection work with k_work_init_delayable(&priv->suspended_work,
  suspended_handler) inside it82xx2_enable() (the driver's .enable op) in
  drivers/usb/udc/udc_it82xx2…
summary: >-
  The ITE it82xx2 USB device-controller driver initialized its bus-suspend
  detection work with k_work_init_delayable(&priv->suspended_work,
  suspended_handler) inside it82xx2_enable() (the driver's .enable op) in
  drivers/usb/udc/udc_it82xx2…
severity: medium
cvss: 4.6
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-666
vendor: zephyrproject
product: zephyr
affected:
  - zephyr >= 3.7.0 < 4.4.2
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T21:10:41.650'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-16148'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/350fd5dfd49e6aca99724fb3f0d4998fe28b4b6c
    label: vulnerabilities@zephyrproject.org
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fvp9-j2pq-477x
    label: vulnerabilities@zephyrproject.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T20:06:24.030736Z'
ingestedAt: '2026-09-14T20:14:21.145Z'
epss: 0.00167
epssPercentile: 0.06338
---

## Overview

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with k_work_init_delayable(&priv->suspended_work, suspended_handler) inside it82xx2_enable() (the driver's .enable op) in drivers/usb/udc/udc_it82xx2.c. This work item is scheduled essentially continuously while the USB bus is active: the interrupt handler reschedules it on every SOF frame and suspended_handler() reschedules itself, so its timeout node is normally linked in the kernel timeout list / a workqueue pending queue.

k_work_init_delayable() (kernel/work.c) unconditionally overwrites the entire k_work_delayable structure, including its timeout and queue linkage, with no busy check. Because it82xx2_disable() does not cancel the work, a normal disable-then-enable cycle re-runs api->enable() (udc_enable() only rejects a redundant enable, not a re-enable after disable) and re-initializes the still-pending work in place, corrupting the kernel timeout/workqueue linked lists and causing a kernel panic.

An external USB host — for example a host performing USB DFU detach (dfu-util --detach) or forcing repeated attach/reset/re-enumeration — drives the udc_disable()/udc_enable() transitions and controls suspend/resume timing, so it can arrange for the suspend work to be pending across a re-enable. This yields an unauthenticated denial of service (kernel panic) reachable across the USB boundary from a removable, physically-connected host, with no confidentiality or integrity impact demonstrated.

The fix moves the k_work_init_delayable() call into the one-time preinit function so the work is initialized exactly once, eliminating the re-initialization of an in-use item.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.