CVE-2026-12052: Zephyr Usb Net Buf Add Mem Unbounded Wlengthcve-2026-12052-zephyr-usb-net-buf-add-mem-unbounded-wlength
USB control request handler copies fixed-size structure data into a net_buf using net_buf_add_mem with sizeof(...) without bounding by setup->wLength. If the host supplies a smaller wLength, this causes an out-of-bounds write. Bound the copied length using MIN(sizeof(...), setup->wLength).
