Executive brief
A vulnerability in the NXP LPUART serial driver for the Zephyr operating system can allow a local user to crash the entire system. By providing an invalid configuration to the serial port, an attacker can cause the hardware to enter an unusable state that triggers a fatal system error. This results in a complete denial of service, requiring a manual reboot to restore operations.
Technical details
A denial of service vulnerability exists in the NXP LPUART serial driver (`drivers/serial/uart_mcux_lpuart.c`) when `CONFIG_UART_USE_RUNTIME_CONFIGURE` is enabled. The `mcux_lpuart_configure()` function calls `LPUART_Deinit()` at the start of the routine, which disables peripheral clocks before validating the user-supplied configuration. If the configuration (parity, data bits, etc.) is unsupported, the function returns `-ENOTSUP` without re-enabling the clocks. Subsequent attempts to access the gated peripheral registers via syscalls or interrupt handlers result in a hard fault. An unprivileged userspace thread can deterministically trigger this crash via the `uart_configure()` syscall. The issue is fixed in version 4.5.0 by replacing the clock de-initialization with a simple transmitter/receiver disable.
Affected products
- Zephyr Project Zephyr RTOS >= 2.5.0, <= 4.4.1
Timeline
- 2026-07-20: advisory: GitHub Security Advisory published by Zephyr Project
- 2026-07-21: disclosed: CVE-2026-10674 published to NVD
- 2026-07-21: patched: Fix merged into main and stable branches