CVE-2026-90834

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description User-mode syscall verifiers for the 16-bit UART API in drivers/serial/uart handlers.c validate the incorrect driver operation. Specifically, the functions z vrfy uart poll out u16(), z vrfy uart tx u16(), and z vrfy uart rx enable u16() verify 8-bit operations instead of the 16-bit operations used by their corresponding implementations. Consequently, the functions z impl uart poll out u16(), z impl uart tx u16(), and z impl uart rx enable u16() in include/zephyr/drivers/uart/uart internal.h perform indirect calls through NULL function pointers when running at supervisor privilege.

In builds with CONFIG USERSPACE and CONFIG UART WIDE DATA (and CONFIG UART ASYNC API for certain variants), an unprivileged user-mode thread with access to a UART device object can trigger a CPU exception in the kernel context. This leads to a system halt or warm-reboot, allowing a sandboxed thread to cause a denial of service for the entire device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.