CVE-2026-10642: dos in zephyrproject zephyr
The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the interrupt-driven application callback while the TX interrupt mask bit (PL011_IMSC_TXIM) is set, to work around the controller's level-transition TX-interrupt behavior. When CTS hardware flow control is enabled (devicetree hw-flow-control or runtime UART_CFG_FLOW_CTRL_RTS_CTS) and the wired serial peer de-asserts CTS, the controller stops draining the TX FIFO; pl011_fifo_fill() then returns 0 on every call while the application still has pending data and therefore never disables the TX interrupt. The loop condition never clears, so the thread that called uart_irq_tx_enable() (e.g. h4_send() in the Bluetooth HCI H4 driver) spins indefinitely, hanging the executing context and stalling the transport — a denial of service (CWE-835). An attacker controlling the device attached to the UART's CTS line can trigger the hang by withholding CTS during transmission. Because that peer is the device wired to the UART — which may be a removable or external module (e.g. an off-board Bluetooth controller on the HCI H4 link) rather than a permanently-bonded on-PCB part — the attack vector is scored Adjacent (AV:A) rather than Physical; the security subcommittee should confirm the vector against the specific deployment. Impact is availability only; there is no memory-safety, confidentiality, or integrity consequence. The vulnerable loop was introduced in commit b783bc8448ef (Feb 2025) and shipped in releases v4.1.0 through v4.4.0. The fix breaks out of the loop when CTS is blocking and arms the CTS modem-status interrupt to resume transmission when CTS re-asserts.
AI Analysis
Technical Summary
The Zephyr PL011 UART driver contains an unbounded software loop in the pl011_irq_tx_enable() function. When CTS hardware flow control is enabled and the UART peer device de-asserts CTS, the TX FIFO stops draining, causing pl011_fifo_fill() to return zero repeatedly. The driver never disables the TX interrupt, resulting in an infinite loop that causes the calling thread (e.g., h4_send() in the Bluetooth HCI H4 driver) to spin indefinitely, leading to a denial of service. The vulnerability affects Zephyr versions 4.1.0 through 4.4.0 and was introduced in commit b783bc8448ef (Feb 2025). The fix breaks out of the loop when CTS is blocking and uses the CTS modem-status interrupt to resume transmission when CTS re-asserts. The attack vector is adjacent, as it requires control of the UART CTS line by a connected device.
Potential Impact
The vulnerability causes a denial of service by hanging the transmitting thread, which stalls UART communication and affects system availability. There are no impacts on confidentiality or integrity. The attack requires an attacker to control the UART CTS line, typically a device physically connected or adjacent to the vulnerable system. This limits the attack vector to adjacent access rather than remote or physical access.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described breaks out of the unbounded loop when CTS is blocking and arms the CTS modem-status interrupt to resume transmission when CTS re-asserts. Until an official fix is available, avoid enabling CTS hardware flow control with the affected PL011 UART driver versions or ensure the connected UART device does not de-assert CTS during transmission.
CVE-2026-10642: dos in zephyrproject zephyr
Description
The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the interrupt-driven application callback while the TX interrupt mask bit (PL011_IMSC_TXIM) is set, to work around the controller's level-transition TX-interrupt behavior. When CTS hardware flow control is enabled (devicetree hw-flow-control or runtime UART_CFG_FLOW_CTRL_RTS_CTS) and the wired serial peer de-asserts CTS, the controller stops draining the TX FIFO; pl011_fifo_fill() then returns 0 on every call while the application still has pending data and therefore never disables the TX interrupt. The loop condition never clears, so the thread that called uart_irq_tx_enable() (e.g. h4_send() in the Bluetooth HCI H4 driver) spins indefinitely, hanging the executing context and stalling the transport — a denial of service (CWE-835). An attacker controlling the device attached to the UART's CTS line can trigger the hang by withholding CTS during transmission. Because that peer is the device wired to the UART — which may be a removable or external module (e.g. an off-board Bluetooth controller on the HCI H4 link) rather than a permanently-bonded on-PCB part — the attack vector is scored Adjacent (AV:A) rather than Physical; the security subcommittee should confirm the vector against the specific deployment. Impact is availability only; there is no memory-safety, confidentiality, or integrity consequence. The vulnerable loop was introduced in commit b783bc8448ef (Feb 2025) and shipped in releases v4.1.0 through v4.4.0. The fix breaks out of the loop when CTS is blocking and arms the CTS modem-status interrupt to resume transmission when CTS re-asserts.
CVSS v3.1
Score 4.6medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Zephyr PL011 UART driver contains an unbounded software loop in the pl011_irq_tx_enable() function. When CTS hardware flow control is enabled and the UART peer device de-asserts CTS, the TX FIFO stops draining, causing pl011_fifo_fill() to return zero repeatedly. The driver never disables the TX interrupt, resulting in an infinite loop that causes the calling thread (e.g., h4_send() in the Bluetooth HCI H4 driver) to spin indefinitely, leading to a denial of service. The vulnerability affects Zephyr versions 4.1.0 through 4.4.0 and was introduced in commit b783bc8448ef (Feb 2025). The fix breaks out of the loop when CTS is blocking and uses the CTS modem-status interrupt to resume transmission when CTS re-asserts. The attack vector is adjacent, as it requires control of the UART CTS line by a connected device.
Potential Impact
The vulnerability causes a denial of service by hanging the transmitting thread, which stalls UART communication and affects system availability. There are no impacts on confidentiality or integrity. The attack requires an attacker to control the UART CTS line, typically a device physically connected or adjacent to the vulnerable system. This limits the attack vector to adjacent access rather than remote or physical access.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described breaks out of the unbounded loop when CTS is blocking and arms the CTS modem-status interrupt to resume transmission when CTS re-asserts. Until an official fix is available, avoid enabling CTS hardware flow control with the affected PL011 UART driver versions or ensure the connected UART device does not de-assert CTS during transmission.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:11:43.570Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3c501d4853345fc1e45bb2
Added to database: 06/24/2026, 21:46:05 UTC
Last enriched: 07/15/2026, 10:46:07 UTC
Last updated: 08/09/2026, 00:41:11 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.