The Zephyr PL011 UART driver contains an unbounded loop in pl011_irq_tx_enable() that repeatedly calls the interrupt-driven application callback while the TX interrupt mask bit is set. When CTS hardware flow control is enabled and the CTS line is de-asserted by the connected device, the TX FIFO stops draining, causing pl011_fifo_fill() to return 0 repeatedly while data remains pending. This prevents disabling the TX interrupt, causing the calling thread to spin indefinitely and hang, resulting in a denial of service. The vulnerability affects Zephyr versions 4.1.0 through 4.4.0 and was introduced in February 2025. The fix breaks the loop when CTS blocks transmission and arms the CTS modem-status interrupt to resume transmission when CTS is re-asserted.

The vulnerability causes a denial of service by hanging the thread responsible for UART transmission when CTS hardware flow control is enabled and the CTS line is withheld by the connected device. This stalls the transport layer and impacts system availability. There are no impacts on confidentiality, integrity, or memory safety.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix described breaks out of the unbounded loop when CTS blocks transmission and uses the CTS modem-status interrupt to resume transmission. Users should monitor the Zephyr project advisories for an official patch or update that includes this fix. Until then, avoid configurations that enable CTS hardware flow control with devices that might withhold CTS during transmission.