CVE-2026-10674

Name of the Vulnerable Software and Affected Versions Zephyr versions 2.5.0 through 3.x

Description When CONFIG UART USE RUNTIME CONFIGURE is enabled, the NXP LPUART serial driver in drivers/serial/uart mcux lpuart.c calls the LPUART Deinit() function at the beginning of mcux lpuart configure(), which disables the LPUART peripheral clocks. Because the configuration is validated only after this call in mcux lpuart configure basic(), providing unsupported parity, data-bit, stop-bit, or flow-control values causes the function to return -ENOTSUP without re-enabling the clock. This leaves the LPUART in a clock-disabled state, where any subsequent access to LPUART registers via poll out, poll in, interrupt handling, or reconfiguration attempts results in a hard fault and a system crash. Since the uart configure() syscall verifier z vrfy uart configure() does not validate the configuration content, an unprivileged userspace thread with LPUART access can trigger a persistent system-wide denial of service.

Recommendations Update Zephyr to a version where the LPUART Deinit() call is removed from mcux lpuart configure() and replaced with logic that only disables the transmitter and receiver while keeping the clock running.