CVE-2026-10674

Analyzed Analyzed - Analysis Complete

LPUART Hard Fault Due to Clock Gating in Zephyr RTOS

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: Zephyr Project

Description

The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the start of mcux_lpuart_configure(), which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards (in mcux_lpuart_configure_basic), and unsupported parity/data-bit/stop-bit/flow-control values return -ENOTSUP before the clock is re-enabled. As a result, a uart_configure() request with an unsupported configuration left the LPUART in a clock-disabled state; any subsequent access to LPUART registers (poll_out/poll_in, interrupt handling, or a later reconfigure) faults on the gated peripheral and escalates to a hard fault, crashing the system. uart_configure() is a Zephyr syscall whose verifier (z_vrfy_uart_configure) only checks that cfg is readable user memory and forwards the caller-supplied configuration unchanged, so an unprivileged userspace thread with access to an LPUART device can deterministically trigger the fault, a persistent system-wide denial of service. Introduced in v2.5.0 and present in all subsequent releases until this fix, which removes the LPUART_Deinit() call and instead only disables the transmitter/receiver, leaving the clock running.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-10674

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	From 2.5.0 (inc) to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability affects the NXP LPUART serial driver in Zephyr RTOS. When a specific configuration flag is enabled, the driver incorrectly disables the LPUART peripheral clocks before validating the requested configuration. If the configuration is unsupported, the clocks remain disabled, causing any subsequent access to the LPUART to crash the system with a hard fault.

Detection Guidance

This vulnerability is specific to systems running Zephyr RTOS with the NXP LPUART driver and CONFIG_UART_USE_RUNTIME_CONFIGURE enabled. Detection requires checking the kernel configuration and driver state. Inspect Zephyr build configurations for CONFIG_UART_USE_RUNTIME_CONFIGURE and verify if the LPUART driver is present. Monitor system logs for hard faults or crashes during UART operations.

Impact Analysis

An unprivileged userspace thread with access to an LPUART device can trigger this flaw to cause a persistent system-wide denial of service by crashing the system. This leads to complete loss of functionality for the affected device.

Compliance Impact

This vulnerability primarily causes a system-wide denial of service by crashing the system through a hard fault. It does not directly affect data confidentiality, integrity, or privacy, which are key concerns for standards like GDPR or HIPAA. However, persistent system crashes could disrupt services that process or store regulated data, potentially leading to compliance issues if critical operations are interrupted.

Mitigation Strategies

Apply the official patch that removes LPUART_Deinit() from the driver. If a patch is unavailable, disable CONFIG_UART_USE_RUNTIME_CONFIGURE in the kernel configuration to prevent runtime UART configuration. Ensure no unprivileged userspace threads have access to LPUART devices.

Hi! I’m here to help you understand CVE-2026-10674. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70