CVE-2026-10642— Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control
Quick assessment
Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Zephyr是Zephyr组织开源的一个可扩展的实时操作系统 (RTOS)。 Zephyr 4.1.0版本至4.4.0版本存在资源管理错误漏洞，该漏洞源于PL011 UART驱动中pl011_irq_tx_enable()函数存在无限循环，可能导致拒绝服务。以下版本受到影响：4.1.0版本至4.4.0版本。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| zephyrproject | zephyr | 4.1.0< 4.5.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10642
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control
Source: CVE Program / CVE List V5
Vulnerability Description
The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the interrupt-driven application callback while the TX interrupt mask bit (PL011_IMSC_TXIM) is set, to work around the controller's level-transition TX-interrupt behavior.
When CTS hardware flow control is enabled (devicetree hw-flow-control or runtime UART_CFG_FLOW_CTRL_RTS_CTS) and the wired serial peer de-asserts CTS, the controller stops draining the TX FIFO; pl011_fifo_fill() then returns 0 on every call while the application still has pending data and therefore never disables the TX interrupt. The loop condition never clears, so the thread that called uart_irq_tx_enable() (e.g. h4_send() in the Bluetooth HCI H4 driver) spins indefinitely, hanging the executing context and stalling the transport — a denial of service (CWE-835).
An attacker controlling the device attached to the UART's CTS line can trigger the hang by withholding CTS during transmission. Because that peer is the device wired to the UART — which may be a removable or external module (e.g. an off-board Bluetooth controller on the HCI H4 link) rather than a permanently-bonded on-PCB part — the attack vector is scored Adjacent (AV:A) rather than Physical; the security subcommittee should confirm the vector against the specific deployment. Impact is availability only; there is no memory-safety, confidentiality, or integrity consequence.
The vulnerable loop was introduced in commit b783bc8448ef (Feb 2025) and shipped in releases v4.1.0 through v4.4.0. The fix breaks out of the loop when CTS is blocking and arms the CTS modem-status interrupt to resume transmission when CTS re-asserts.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Vulnerability Title
Zephyr 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Zephyr是Zephyr组织开源的一个可扩展的实时操作系统 (RTOS)。 Zephyr 4.1.0版本至4.4.0版本存在资源管理错误漏洞，该漏洞源于PL011 UART驱动中pl011_irq_tx_enable()函数存在无限循环，可能导致拒绝服务。以下版本受到影响：4.1.0版本至4.4.0版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| zephyrproject | zephyr | 4.1.0 ~ 4.5.0 | - |
|
II. Public POCs for CVE-2026-10642
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10642
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-10642 (1)
Vendor Advisories for CVE-2026-10642 (1)
IV. Related Vulnerabilities
Same product: zephyr
-
CVE-2026-15894
Bluetooth Mesh solicitation PDU stack buffer overflow via ov -
CVE-2026-19186
Integer underflow in IEEE 802.15.4 frame decryption leads to -
CVE-2026-19185
Unvalidated user-supplied buffer pointers in the I3C do_ccc -
CVE-2026-19184
Out-of-bounds write in the NXP GAU ADC driver due to byte-ve -
CVE-2026-17053
SMBus callback-removal syscalls accept an unvalidated user p
Same vendor: zephyrproject
-
CVE-2026-15894
Bluetooth Mesh solicitation PDU stack buffer overflow via ov -
CVE-2026-19186
Integer underflow in IEEE 802.15.4 frame decryption leads to -
CVE-2026-19185
Unvalidated user-supplied buffer pointers in the I3C do_ccc -
CVE-2026-19184
Out-of-bounds write in the NXP GAU ADC driver due to byte-ve -
CVE-2026-17053
SMBus callback-removal syscalls accept an unvalidated user p
Same weakness: CWE-835
-
CVE-2026-107577
Loop with Unreachable Exit Condition ('Infinite Loop') in hM -
CVE-2026-106164
Infinite Loop in Telerik Document Processing XLS Import -
CVE-2026-106568
ImageMagick: Infinite Loop when reading a crafted XMP profil -
CVE-2026-107168
M17n-lib: parser infinite loop on malformed utf-8 in count_u -
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never te
V. Comments for CVE-2026-10642
No comments yet