PT-2026-62122 · Zephyrproject · Zephyr

CVE-2026-10674 · Publicado 2026-07-21 · Atualizado 2026-07-21

NVD

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The NXP LPUART serial driver (drivers/serial/uart mcux lpuart.c), when CONFIG UART USE RUNTIME CONFIGURE is enabled, called LPUART Deinit() at the start of mcux lpuart configure(), which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards (in mcux lpuart configure basic), and unsupported parity/data-bit/stop-bit/flow-control values return -ENOTSUP before the clock is re-enabled.

As a result, a uart configure() request with an unsupported configuration left the LPUART in a clock-disabled state; any subsequent access to LPUART registers (poll out/poll in, interrupt handling, or a later reconfigure) faults on the gated peripheral and escalates to a hard fault, crashing the system.

uart configure() is a Zephyr syscall whose verifier (z vrfy uart configure) only checks that cfg is readable user memory and forwards the caller-supplied configuration unchanged, so an unprivileged userspace thread with access to an LPUART device can deterministically trigger the fault, a persistent system-wide denial of service.

Introduced in v2.5.0 and present in all subsequent releases until this fix, which removes the LPUART Deinit() call and instead only disables the transmitter/receiver, leaving the clock running.

Correção

Assertion Failure

Enumeração de Fraquezas

CWE-617

Identificadores relacionados

CVE-2026-10674

Produtos afetados

Zephyr

Referências · 3

• https://github.com/zephyrproject-rtos/zephyr/commit/f56935c46fdf6559a20ad8484b29896ecac5808f · Correção
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mw68-r353-m3vf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-10674 · Nota de Segurança