CVE-2026-10674

{
  "id": "CVE-2026-10674",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T22:16:58.740",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the start of mcux_lpuart_configure(), which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards (in mcux_lpuart_configure_basic), and unsupported parity/data-bit/stop-bit/flow-control values return -ENOTSUP before the clock is re-enabled.\n\nAs a result, a uart_configure() request with an unsupported configuration left the LPUART in a clock-disabled state; any subsequent access to LPUART registers (poll_out/poll_in, interrupt handling, or a later reconfigure) faults on the gated peripheral and escalates to a hard fault, crashing the system.\n\nuart_configure() is a Zephyr syscall whose verifier (z_vrfy_uart_configure) only checks that cfg is readable user memory and forwards the caller-supplied configuration unchanged, so an unprivileged userspace thread with access to an LPUART device can deterministically trigger the fault, a persistent system-wide denial of service.\n\nIntroduced in v2.5.0 and present in all subsequent releases until this fix, which removes the LPUART_Deinit() call and instead only disables the transmitter/receiver, leaving the clock running."
    },
    {
      "lang": "es",
      "value": "El controlador serie NXP LPUART (drivers/serial/uart_mcux_lpuart.c), cuando CONFIG_UART_USE_RUNTIME_CONFIGURE está habilitado, llamaba a LPUART_Deinit() al inicio de mcux_lpuart_configure(), lo que deshabilita los relojes periféricos LPUART. La configuración solicitada se valida solo después (en mcux_lpuart_configure_basic), y los valores no admitidos de paridad/bits de datos/bits de parada/control de flujo devuelven -ENOTSUP antes de que el reloj se vuelva a habilitar.\n\nComo resultado, una solicitud de uart_configure() con una configuración no admitida dejaba el LPUART en un estado con el reloj deshabilitado; cualquier acceso posterior a los registros LPUART (poll_out/poll_in, manejo de interrupciones o una reconfiguración posterior) falla en el periférico bloqueado y escala a un fallo grave, bloqueando el sistema.\n\nuart_configure() es una llamada al sistema (syscall) de Zephyr cuyo verificador (z_vrfy_uart_configure) solo verifica que cfg es memoria de usuario legible y reenvía la configuración proporcionada por el llamador sin cambios, por lo que un hilo de espacio de usuario sin privilegios con acceso a un dispositivo LPUART puede desencadenar la falla de forma determinista, una denegación de servicio persistente a nivel de todo el sistema.\n\nIntroducido en la v2.5.0 y presente en todas las versiones posteriores hasta esta corrección, que elimina la llamada a LPUART_Deinit() y en su lugar solo deshabilita el transmisor/receptor, dejando el reloj en funcionamiento."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "zephyrproject",
          "product": "zephyr",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com/zephyrproject-rtos/zephyr",
          "packageName": "zephyr",
          "programFiles": [
            "drivers/serial/uart_mcux_lpuart.c"
          ],
          "versions": [
            {
              "version": "3.7.0",
              "lessThan": "4.3.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.4.0",
              "lessThan": "4.4.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T19:32:08.144813Z",
          "id": "CVE-2026-10674",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-617"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.5.0",
              "versionEndIncluding": "4.4.1",
              "matchCriteriaId": "E03F3A48-9F88-412D-B4A0-2156F391EA7B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/commit/f56935c46fdf6559a20ad8484b29896ecac5808f",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mw68-r353-m3vf",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}