CVE-2026-90585

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An issue exists in the Renesas RA SCI UART driver where the receive-error Interrupt Service Routine (ISR), uart ra sci eri isr() in drivers/serial/uart renesas ra sci.c, fails to acknowledge error conditions when a Zephyr interrupt-driven callback is not registered. When CONFIG UART INTERRUPT DRIVEN=y and CONFIG UART ASYNC API=n are set, and the data->user cb variable is NULL, the ISR body remains empty. This leaves the SCI error flags (SSR.ORER, SSR.FER, SSR.PER) set and the ICU event flag R ICU->IELSR b[eri irq].IR uncleared, causing the interrupt to re-pend immediately and the ISR to be re-entered indefinitely.

This state can be triggered by a receive line error, such as an overrun, framing, parity, or break condition, which can be induced by a peer device transmitting at a mismatched baud rate or asserting a break. The impact is a complete system hang as the CPU becomes trapped in the ISR, affecting system availability until a hardware watchdog or external reset occurs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.