Zephyr OS ARM PL011 UART Driver Unhandled Error Interrupt Storm DoS (CVE-2026-12529)

PL011 UART Incorrect Interrupt Clearing Leading to External Peer Interrupt Storm Denial of Service Vulnerability Overview The ARM PL011 UART driver in fails to correctly clear receive error interrupts. On the PL011, framing errors, parity errors, interrupt, and overflow error interrupts (cleared via ) are only cleared for RX interrupts and per-byte RSR status by writing to the Interrupt Clear Register , but the error status bits are not cleared. The Interrupt Service Routine (ISR) only acknowledges CTS modem status interrupts and does not write to to clear error bits, causing error interrupts to remain pending. When an application enables error interrupt reporting via the public API , an attacker can deliberately trigger these error bits by injecting error bits onto the RX line (e.g., baud rate mismatch or parity errors). Since the error interrupts are not cleared, the interrupt line remains asserted. The CPU continuously calls , generating an interrupt storm that prevents the core from performing any other operations. Affected Versions Affected Versions: >= 1.14.0, < 4.4.2 Fixed Version: 4.4.2 CVSS Score: 4.0 / 10 CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-12529 Weakness: CWE-895 Remediation Fixed In: Merged in Expected Fixed Version: 4.5.0 (The fix has been merged into the branch but has not yet been released; this prediction should be confirmed based on the actual release). Introduced In: The original PL011 driver (commit , “serial: Support ARM PL011 UART”), present since the v4.0.0 series. Patches Evidence — Before the fix, did not write to to clear , resulting in permanently pending error interrupts. — enables FE/PE/BE/OE interrupts (the only path to trigger the storm). — only clears RSR after reading; before the fix, it was not cleared, resulting in stale error states (the bug was named by the submitter as observable but not a DoS). — ; these bits are cleared via ICR writes. — Contains and the ISR failing to clear error bits, confirming the defect exists in v4.0.0 (reportable). No calls to found in (grep) — Error interrupts are optional for applications; attacker accessibility may be "No". More Information For any questions or comments, please submit an issue to . Email: Embargo date: 2026-08-16

Goal Reached Thanks to every supporter — we hit 100%!

Zephyr OS ARM PL011 UART Driver Unhandled Error Interrupt Storm DoS (CVE-2026-12529)

More from this source