Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-12629— PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zephyr是Zephyr组织开源的一款面向物联网的实时操作系统。 Zephyr 1.14.0至4.4.2之前版本存在资源管理错误漏洞，该漏洞源于drivers/serial/uart_pl011.c文件中的ARM PL011 UART驱动未确认接收错误中断，导致错误中断持续触发，可能允许攻击者注入线路错误造成中断风暴，从而引发拒绝服务。

CVSS 4.6 · Medium EPSS 0.17% · P6

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 1.14.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12629

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts. On the PL011, the framing, parity, break, and overrun error interrupts (PL011_IMSC_ERROR_MASK) are cleared only by writing the interrupt-clear register UARTICR; reading the data register clears the RX interrupt and the per-byte RSR status but not the error interrupt status in MIS. The interrupt service routine pl011_isr() acknowledged only the CTS modem-status interrupt and never wrote icr for the error bits, so an asserted error interrupt remains pending after the ISR returns. When an application enables error-interrupt reporting via the public uart_irq_err_enable() API, an attacker who controls the serial peer can deterministically assert these error bits by injecting line errors on the RX line — a baud/stop-bit mismatch or mid-character break (framing/break error), a flipped parity bit (parity error), or FIFO flooding (overrun error). Because the error interrupt is never cleared, the interrupt line stays asserted and the CPU re-enters pl011_isr() immediately and indefinitely, producing an interrupt-storm livelock from which the core makes no forward progress. The impact is an availability-only denial of service (permanent hang), reachable from an external or removable UART peer. Exploitation is gated by configuration: the error interrupt is off by default and no in-tree subsystem enables it, so only applications that explicitly call uart_irq_err_enable() on a PL011-based, interrupt-driven port are affected. The fix makes pl011_isr() acknowledge the pending error bits via uart->icr, breaking the loop, and additionally clears the latched RSR status in pl011_err_check().
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Vulnerability Title
Zephyr 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Zephyr是Zephyr组织开源的一款面向物联网的实时操作系统。 Zephyr 1.14.0至4.4.2之前版本存在资源管理错误漏洞，该漏洞源于drivers/serial/uart_pl011.c文件中的ARM PL011 UART驱动未确认接收错误中断，导致错误中断持续触发，可能允许攻击者注入线路错误造成中断风暴，从而引发拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 1.14.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-12629

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-12629

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-12629 (1)

Vendor Advisories for CVE-2026-12629 (1)

Same Patch Batch · zephyrproject · 2026-08-17 · 4 CVEs total

CVE-2026-9771 8.8 HIGH Missing device-pointer validation in flash_copy() syscall allows userspace privilege escal
CVE-2026-12519 5.0 MEDIUM Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing
CVE-2026-12630 4.3 MEDIUM 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-835

V. Comments for CVE-2026-12629

No comments yet

Leave a comment