CVE-2026-12629

Name of the Vulnerable Software and Affected Versions ARM PL011 UART driver (affected versions not specified)

Description The ARM PL011 UART driver in drivers/serial/uart pl011.c fails to acknowledge receive error interrupts. Specifically, the interrupt service routine pl011 isr() does not write to the interrupt-clear register UARTICR for error bits, leaving framing, parity, break, and overrun error interrupts pending. If an application enables error-interrupt reporting via the uart irq err enable() API, a remote attacker controlling the serial peer can inject line errors—such as baud/stop-bit mismatches, flipped parity bits, or FIFO flooding—to trigger these interrupts. This results in an interrupt-storm livelock where the CPU continuously re-enters pl011 isr(), leading to a permanent system hang and denial of service.

Recommendations Update the driver to ensure pl011 isr() acknowledges pending error bits via uart->icr and clears the latched RSR status in pl011 err check(). As a temporary mitigation, avoid calling the uart irq err enable() API on PL011-based, interrupt-driven ports.