CVE-2026-10642: Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control
The Zephyr PL011 UART driver (drivers/serial/uartpl011.c) contains an unbounded software loop in pl011irqtxenable() that repeatedly invokes the interrupt-driven application callback while the TX interrupt mask bit (PL011IMSCTXIM) is set, to work around the controller's level-transition TX-interrupt behavior.
When CTS hardware flow control is enabled (devicetree hw-flow-control or runtime UARTCFGFLOWCTRLRTSCTS) and the wired serial peer de-asserts CTS, the controller stops draining the TX FIFO; pl011fifofill() then returns 0 on every call while the application still has pending data and therefore never disables the TX interrupt. The loop condition never clears, so the thread that called uartirqtxenable() (e.g. h4send() in the Bluetooth HCI H4 driver) spins indefinitely, hanging the executing context and stalling the transport — a denial of service (CWE-835).
An attacker controlling the device attached to the UART's CTS line can trigger the hang by withholding CTS during transmission. Because that peer is the device wired to the UART — which may be a removable or external module (e.g. an off-board Bluetooth controller on the HCI H4 link) rather than a permanently-bonded on-PCB part — the attack vector is scored Adjacent (AV:A) rather than Physical; the security subcommittee should confirm the vector against the specific deployment. Impact is availability only; there is no memory-safety, confidentiality, or integrity consequence.
The vulnerable loop was introduced in commit b783bc8448ef (Feb 2025) and shipped in releases v4.1.0 through v4.4.0. The fix breaks out of the loop when CTS is blocking and arms the CTS modem-status interrupt to resume transmission when CTS re-asserts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zephyr PL011 UART driver (drivers/serial/uart_pl011.c)to a version that resolves this vulnerability.Patch Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control - Configuration
Disable CTS hardware flow control so that de-asserted CTS cannot stall TX FIFO draining and trigger the unbounded TX busy-loop DoS.
Zephyr UART devicetree hw-flow-control / UART_CFG_FLOW_CTRL_RTS_CTS = disabled - Compensating control
If CTS hardware flow control cannot be disabled, restrict/physically isolate the UART CTS-connected peer device (the device wired to the UART may be removable/external) from an attacker so the attacker cannot withhold/de-assert CTS.
Event History
Frequently Asked Questions
What is CVE-2026-10642?
CVE-2026-10642 is a vulnerability in the Zephyr PL011 UART driver that can cause a denial-of-service (DoS) due to an unbounded software loop.
What is the severity of CVE-2026-10642?
The severity of CVE-2026-10642 is rated as medium, with a CVSS score of 6.5.
How do I fix CVE-2026-10642?
To fix CVE-2026-10642, users should update to the latest version of the Zephyr Project that includes the patched driver.
What impact does CVE-2026-10642 have on systems?
CVE-2026-10642 can lead to a denial-of-service condition by causing excessive CPU load due to a busy-loop in the UART driver.
Is there a workaround for CVE-2026-10642?
There are no known workarounds for CVE-2026-10642; the recommended action is to apply the software update.