UART Driver Vulnerability in ARM PL011 Affects Zephyr RTOS

CVE-2026-12629

What is CVE-2026-12629?

The ARM PL011 UART driver in Zephyr RTOS has a vulnerability due to inadequate handling of receive error interrupts. Specifically, the driver fails to acknowledge various error conditions such as framing, parity, break, and overrun errors that can lead to a denial of service. When error-interrupt reporting is enabled, an attacker can exploit this vulnerability by injecting line errors into the RX line. The exploitation could cause the system to enter a state of continuous interrupt processing without making any forward progress, resulting in a permanent hang. The vulnerability affects applications that explicitly enable error interrupts on PL011-based ports. A fix has been implemented to ensure that the driver adequately acknowledges pending error interrupts, thus preventing the aforementioned issue.

References