Zephyr RTOS CVE-2026-10674

Three conditions must all be true simultaneously: (1) CONFIG_UART_USE_RUNTIME_CONFIGURE must be enabled in the Zephyr build's Kconfig - this is an opt-in feature not present in many minimal production firmware images; (2) the target hardware must use an NXP LPUART peripheral managed by the drivers/serial/uart_mcux_lpuart.c driver, restricting the affected surface to NXP MCU families (i.MX RT, LPC, Kinetis) rather than all Zephyr targets; and (3) the attacker's thread must hold Zephyr userspace permission to call uart_configure() on an LPUART device node, meaning the device must have been explicitly opened or granted to that thread by the application or device manager. Exploitation is blocked if any one condition is absent: non-NXP targets, builds omitting runtime configure support, and configurations restricting LPUART access to privileged threads are all unaffected. The CVSS PR:L vector confirms authentication is required at the level of a low-privileged local user or application thread.

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the exploit mechanics: local access, low privilege, deterministic triggering, availability-only impact with no confidentiality or integrity consequence. In general-purpose computing this score would represent a moderate, lower-priority finding. In embedded and safety-adjacent contexts typical of Zephyr deployments (industrial controllers, medical devices, automotive ECUs), a hard fault causing a system reset is operationally critical and may have safety implications beyond raw CVSS scoring. No EPSS score was provided; exploitation probability is inferred from description and CVSS alone. No CISA KEV listing and no public proof-of-concept code have been identified, meaning this is not currently under active mass exploitation. The vulnerability is gated on CONFIG_UART_USE_RUNTIME_CONFIGURE being enabled, which is not required in many minimal production builds, substantially narrowing the real-world exposed surface. Overall, this is a genuine priority for embedded product teams shipping Zephyr on NXP LPUART hardware with runtime reconfigure enabled, but low urgency for organizations not meeting all three preconditions.

An unprivileged application thread on an NXP i.MX RT device running Zephyr with CONFIG_UART_USE_RUNTIME_CONFIGURE enabled calls uart_configure() on an LPUART device node it has been granted access to, supplying an unsupported parity setting such as UART_CFG_PARITY_MARK. The driver immediately calls LPUART_Deinit(), gating the peripheral clock, then returns -ENOTSUP after failing validation without restoring the clock. The next UART write, read, or interrupt servicing by any thread triggers a bus fault that escalates to a hard fault and resets the device, causing a persistent, attacker-repeatable denial of service on each reboot if the application continues to issue the same call.