CVE-2026-10674 in Zephyr
Summary
by MITRE • 07/22/2026
The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the start of mcux_lpuart_configure(), which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards (in mcux_lpuart_configure_basic), and unsupported parity/data-bit/stop-bit/flow-control values return -ENOTSUP before the clock is re-enabled.
As a result, a uart_configure() request with an unsupported configuration left the LPUART in a clock-disabled state; any subsequent access to LPUART registers (poll_out/poll_in, interrupt handling, or a later reconfigure) faults on the gated peripheral and escalates to a hard fault, crashing the system.
uart_configure() is a Zephyr syscall whose verifier (z_vrfy_uart_configure) only checks that cfg is readable user memory and forwards the caller-supplied configuration unchanged, so an unprivileged userspace thread with access to an LPUART device can deterministically trigger the fault, a persistent system-wide denial of service.
Introduced in v2.5.0 and present in all subsequent releases until this fix, which removes the LPUART_Deinit() call and instead only disables the transmitter/receiver, leaving the clock running.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability exists within the NXP LPUART serial driver implementation in the Zephyr operating system kernel, specifically in the file drivers/serial/uart_mcux_lpuart.c. This flaw manifests when the runtime configuration option CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, creating a critical timing issue in the mcux_lpuart_configure() function execution flow. The driver performs LPUART_Deinit() at the beginning of the configuration process, which completely disables the LPUART peripheral clocks before any validation occurs on the requested parameters.
The technical implementation flaw stems from improper sequence of operations where the peripheral deinitialization occurs prior to configuration validation. When mcux_lpuart_configure() is invoked, it immediately calls LPUART_Deinit(), effectively shutting down all peripheral clocks associated with the LPUART controller. Subsequently, the function validates the requested configuration parameters through mcux_lpuart_configure_basic(), which returns -ENOTSUP for unsupported parity, data-bit, stop-bit, or flow-control values. However, this validation occurs after the clocks have already been disabled, leaving the peripheral in a state where it cannot respond to any register accesses.
This design flaw creates a deterministic system crash condition when an invalid configuration is submitted through the uart_configure() syscall. The vulnerability maps to CWE-681 Incorrect Interpretation of Security Checks and CWE-362 Concurrent Execution using Shared Resources Race Condition, as the system fails to properly handle the transition between peripheral states and configuration validation phases. The timing dependency creates a race condition where the peripheral state becomes inconsistent with the expected operational requirements.
The operational impact is severe and deterministic, providing an unprivileged userspace thread with the ability to trigger a hard fault and system crash. Since uart_configure() is a Zephyr syscall that uses z_vrfy_uart_configure for verification, the security model only validates that the configuration structure is readable from user memory without inspecting or sanitizing the actual configuration values. This allows an attacker to submit malicious configuration parameters that will cause the peripheral to remain in a clock-disabled state after validation failure. Any subsequent access to LPUART registers through poll_out, poll_in operations, interrupt handling, or even reconfiguration attempts will fault on the gated peripheral, resulting in immediate system hard faults.
The vulnerability represents a classic denial of service attack vector with persistent system-wide impact, as demonstrated by the ATT&CK technique T1499.004 - Endpoint Denial of Service and T1562.001 - Impairing Defenses. The flaw affects all Zephyr releases from version 2.5.0 through the affected versions, with the fix implemented by removing the LPUART_Deinit() call and instead only disabling the transmitter and receiver components while maintaining clock operation. This approach ensures that the peripheral remains accessible for register operations even when configuration validation fails, preventing the system crash condition. The fix addresses the root cause by eliminating the problematic sequence where peripheral deinitialization precedes parameter validation, thereby resolving both the immediate security vulnerability and the broader architectural design flaw in the driver's state management logic.