CVE-2026-10674: NXP LPUART Driver DoS Vulnerability

CVE-2026-10674 Overview

CVE-2026-10674 is a denial of service vulnerability in the Zephyr RTOS NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c). When CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, the driver calls LPUART_Deinit() at the start of mcux_lpuart_configure(), disabling the peripheral clock before validating the requested configuration. An unprivileged userspace thread with access to an LPUART device can supply an unsupported parity, data-bit, stop-bit, or flow-control value through the uart_configure() syscall, leaving the peripheral in a clock-gated state. Any subsequent register access triggers a hard fault. The flaw was introduced in Zephyr v2.5.0 and persists through all subsequent releases until the fix.

Critical Impact
A local, low-privileged userspace thread can deterministically crash the system, causing a persistent system-wide denial of service on affected Zephyr builds.

Affected Products

Zephyr RTOS versions from v2.5.0 through releases preceding the patch commit f56935c46fdf6559a20ad8484b29896ecac5808f
Builds that include drivers/serial/uart_mcux_lpuart.c with CONFIG_UART_USE_RUNTIME_CONFIGURE enabled
NXP platforms using the LPUART peripheral (i.MX RT, Kinetis, LPC, S32K families) with Zephyr

Discovery Timeline

2026-07-21 - CVE-2026-10674 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-10674

Vulnerability Analysis

The vulnerability is a reachable assertion / fault condition classified as [CWE-617]. The mcux_lpuart_configure() function tears down the peripheral before validating whether the caller-supplied configuration is supported. When validation in mcux_lpuart_configure_basic rejects an unsupported field, the function returns -ENOTSUP without re-enabling the LPUART clock. The peripheral remains in a clock-disabled state.

Any thread that subsequently touches LPUART registers via poll_out, poll_in, an interrupt handler, or another reconfigure attempt faults on the gated peripheral. The fault escalates to a hard fault and halts the system.

The uart_configure() Zephyr syscall verifier z_vrfy_uart_configure only confirms that the cfg pointer references readable user memory. It forwards the caller-supplied configuration unchanged, so an unprivileged thread with access to the LPUART device node can trigger the condition deterministically.

Root Cause

The root cause is ordering: the driver deinitialized the hardware before validating input. The correct sequence is to validate the requested configuration first and only touch peripheral state once the request is known to be applicable.

Attack Vector

Exploitation requires local access and low privileges. An attacker running an unprivileged userspace thread on a Zephyr application with LPUART access invokes uart_configure() with an unsupported parity, data-bit, stop-bit, or flow-control value, then triggers any UART operation to force the fault.

 static int mcux_lpuart_configure(const struct device *dev,
 				 const struct uart_config *cfg)
 {
-	/* Make sure that RSRC is de-asserted otherwise deinit will hang. */
-	get_base(dev)->CTRL &= ~LPUART_CTRL_RSRC_MASK;
-
-	/* disable LPUART */
-	LPUART_Deinit(get_base(dev));
+	/* Disable Transmitter and Receiver */
+	get_base(dev)->CTRL &= ~(LPUART_CTRL_TE_MASK | LPUART_CTRL_RE_MASK);
 
 	int ret = mcux_lpuart_configure_init(dev, cfg);
 	if (ret) {

Source: Zephyr commit f56935c. The patch removes the LPUART_Deinit() call and instead clears only the transmitter and receiver enable bits (LPUART_CTRL_TE_MASK and LPUART_CTRL_RE_MASK), leaving the peripheral clock running.

Detection Methods for CVE-2026-10674

Indicators of Compromise

Unexpected hard fault events referencing LPUART register access in Zephyr crash logs or fault dumps
Repeated uart_configure() syscall failures returning -ENOTSUP immediately preceding a device reset
Devices entering a boot loop after userspace application activity that touches serial configuration APIs

Detection Strategies

Audit Zephyr build configurations for CONFIG_UART_USE_RUNTIME_CONFIGURE=y combined with uart_mcux_lpuart and cross-reference the base commit against the fix f56935c46fdf6559a20ad8484b29896ecac5808f
Instrument mcux_lpuart_configure() return paths in development builds to log configurations that fail validation with -ENOTSUP
Review userspace applications with K_SYSCALL access to UART devices for calls to uart_configure() with attacker-influenced parameters

Monitoring Recommendations

Collect and centralize Zephyr fault handler output from fleet devices to detect the fault signature on LPUART peripheral accesses
Track firmware versions across deployed NXP-based devices to identify units running vulnerable Zephyr releases (v2.5.0 through pre-fix)
Alert on abnormal device reboot rates that correlate with application updates exposing UART configuration to lower-trust code

How to Mitigate CVE-2026-10674

Immediate Actions Required

Apply the upstream fix from commit f56935c46fdf6559a20ad8484b29896ecac5808f and rebuild affected firmware images
Inventory devices running Zephyr v2.5.0 or later with CONFIG_UART_USE_RUNTIME_CONFIGURE enabled and prioritize them for firmware update
Restrict which userspace threads have K_SYSCALL access to LPUART device objects until firmware is updated

Patch Information

The fix is committed in the Zephyr project at commit f56935c46fdf6559a20ad8484b29896ecac5808f. Full advisory details are published in GHSA-mw68-r353-m3vf. The patch removes the LPUART_Deinit() call in mcux_lpuart_configure() and disables only the transmitter and receiver, preserving the peripheral clock across configuration attempts.

Workarounds

Disable CONFIG_UART_USE_RUNTIME_CONFIGURE if runtime UART reconfiguration is not required by the application
Withdraw LPUART device object access from userspace threads via Zephyr's object permission model so only trusted supervisor code can call uart_configure()
Wrap uart_configure() behind an application-level shim that validates parity, data bits, stop bits, and flow control against the LPUART driver's supported values before forwarding the call

bash

# Kconfig: disable runtime UART reconfiguration until firmware is patched
CONFIG_UART_USE_RUNTIME_CONFIGURE=n