Executive brief
The ARM PL011 UART driver fails to properly clear receive error interrupts, allowing an attacker with control of a serial connection to trigger a permanent interrupt storm that freezes the affected CPU core. Applications using error-interrupt reporting on PL011-based serial ports are vulnerable to denial of service attacks from external or removable UART peers. This vulnerability only affects systems where error interrupts are explicitly enabled, which is not the default configuration.
Technical details
The vulnerability is a missing interrupt-acknowledgment bug in the pl011_isr() interrupt service routine within drivers/serial/uart_pl011.c. The ARM PL011 UART peripheral uses a separate interrupt-clear register (UARTICR) to dismiss error interrupts (framing, parity, break, and overrun errors), but the ISR only acknowledges CTS modem-status interrupts and never writes to icr for error bits. An attacker controlling the serial peer can inject line errors (baud mismatches, mid-character breaks, parity flips, or FIFO overflow) to assert error interrupt bits, which remain pending indefinitely. Because the interrupt is never cleared, the CPU repeatedly re-enters the ISR in a livelock, producing a permanent denial of service. Exploitation requires an application to explicitly enable error-interrupt reporting via uart_irq_err_enable(); the feature is disabled by default and not used by in-tree subsystems. The fix updates pl011_isr() to write the error bits to uart->icr and clears latched RSR status in pl011_err_check().
Affected products
- Linux Linux Kernel <UNKNOWN>
Timeline
- 2026-08-17: disclosed