The ARM PL011 UART driver in Zephyr (drivers/serial/uart_pl011.c) does not properly clear receive error interrupts such as framing, parity, break, and overrun errors. The interrupt service routine (pl011_isr) acknowledges only the CTS modem-status interrupt and neglects to clear error interrupts by writing to the UART interrupt-clear register (UARTICR). When error interrupts are enabled via uart_irq_err_enable(), a malicious UART peer can inject line errors to assert these error bits, causing the interrupt line to remain asserted indefinitely. This results in the CPU repeatedly entering the ISR, creating an interrupt storm livelock and causing a denial of service by permanently hanging the core. The vulnerability is gated by configuration since error interrupts are off by default and no in-tree subsystem enables them. The fix involves modifying pl011_isr() to acknowledge error bits by writing to uart->icr and clearing latched error status in pl011_err_check().

This vulnerability causes an availability impact only, specifically a denial of service through a permanent hang of the affected CPU core. It requires an attacker to control the UART peer to inject line errors and the system to have error interrupt reporting explicitly enabled on a PL011-based UART port. There is no confidentiality or integrity impact. Exploitation is local to the UART interface and not remotely exploitable over a network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, avoid enabling error interrupt reporting via uart_irq_err_enable() on PL011-based UART ports. Monitor vendor communications for an official fix that acknowledges and clears error interrupts properly in the ISR.