CVE-2026-10642

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.1.0 through 4.4.0

Description The PL011 UART driver in drivers/serial/uart pl011.c contains an unbounded software loop within the pl011 irq tx enable() function. This loop repeatedly invokes the interrupt-driven application callback as long as the TX interrupt mask bit PL011 IMSC TXIM remains set. When CTS hardware flow control is enabled via hw-flow-control or UART CFG FLOW CTRL RTS CTS and a connected peer de-asserts CTS, the controller stops draining the TX FIFO. Consequently, the pl011 fifo fill() function returns 0 on every call. If the application has pending data, the TX interrupt is never disabled, causing the loop condition to persist. This results in the calling thread, such as h4 send() in the Bluetooth HCI H4 driver, spinning indefinitely, which hangs the executing context and stalls the transport, leading to a denial of service. An attacker controlling the device attached to the UART's CTS line can trigger this state by withholding CTS during transmission.

Recommendations Update Zephyr versions 4.1.0 through 4.4.0 to a version that includes the fix which breaks the loop when CTS is blocking and arms the CTS modem-status interrupt to resume transmission upon CTS re-assertion.