CVE-2026-10674

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10674
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10674.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10674
Aliases
  • GHSA-mw68-r353-m3vf
Published
2026-07-21T21:30:53Z
Modified
2026-10-28T11:03:52Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled
Details

The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the start of mcux_lpuart_configure(), which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards (in mcux_lpuart_configure_basic), and unsupported parity/data-bit/stop-bit/flow-control values return -ENOTSUP before the clock is re-enabled.

As a result, a uart_configure() request with an unsupported configuration left the LPUART in a clock-disabled state; any subsequent access to LPUART registers (poll_out/poll_in, interrupt handling, or a later reconfigure) faults on the gated peripheral and escalates to a hard fault, crashing the system.

uart_configure() is a Zephyr syscall whose verifier (z_vrfy_uart_configure) only checks that cfg is readable user memory and forwards the caller-supplied configuration unchanged, so an unprivileged userspace thread with access to an LPUART device can deterministically trigger the fault, a persistent system-wide denial of service.

Introduced in v2.5.0 and present in all subsequent releases until this fix, which removes the LPUART_Deinit() call and instead only disables the transmitter/receiver, leaving the clock running.

Database specific 
{
    "cna_assigner":  "zephyr",
    "cwe_ids":  [
        "CWE-617"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10674.json"
}
References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type
GIT
Repo
https://github.com/zephyrproject-rtos/zephyr
Events
Introduced
36940db938a8f4a1e919496793ed439850a221c2
Fixed
75f67d766726351b30199f9a2bf55803d717a3be
Introduced
684c9e8f32e4373a21098559f748f06915f950c9
Fixed
dccb09599635bdff17633fa7e9dab014b91dce90
Fixed
f56935c46fdf6559a20ad8484b29896ecac5808f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.7.0"
                },
                {
                    "fixed":  "4.3.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "4.4.0"
                },
                {
                    "fixed":  "4.4.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "f56935c46fdf6559a20ad8484b29896ecac5808f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v3.*
v3.7.0
v4.*
v4.0.0
v4.0.0-rc1
v4.0.0-rc2
v4.0.0-rc3
v4.1.0
v4.1.0-rc1
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-rc1
v4.2.0-rc2
v4.2.0-rc3
v4.3.0
v4.3.0-rc1
v4.3.0-rc2
v4.3.0-rc3
v4.3.1-rc1
v4.4.0
v4.4.1
v4.4.1-rc1
v4.4.2-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10674.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "62417335587086996896407324574993220026",
                "12542983803633987964839652759764332506",
                "32172322819474248476827923863331629142",
                "259108239341385929729360841963992526135",
                "336848166807233494159993585568973536023"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-10674-a108a5fd",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/f56935c46fdf6559a20ad8484b29896ecac5808f",
        "target":  {
            "file":  "drivers/serial/uart_mcux_lpuart.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "27182370318779562740408033296612827158",
            "length":  270
        },
        "id":  "CVE-2026-10674-b3408680",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/zephyrproject-rtos/zephyr/commit/f56935c46fdf6559a20ad8484b29896ecac5808f",
        "target":  {
            "file":  "drivers/serial/uart_mcux_lpuart.c",
            "function":  "mcux_lpuart_configure"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:03:52Z"