What is the CVSS score of CVE-2026-10674?

CVE-2026-10674 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-10674?

Yes, a patch is available for CVE-2026-10674. Update the affected software to the latest version immediately.

Zephyr RTOS CVE-2026-10674

EUVD-2026-46444 MEDIUM

Reachable Assertion (CWE-617)

2026-07-21 zephyr

Denial Of Service Zephyr Zephyrproject

5.5

CVSS 3.1 · Vendor: zephyr

Severity by source

Vendor (zephyr) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local low-privilege userspace thread triggers deterministic hard fault via unsupported configure call; no confidentiality or integrity impact, only full system availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zephyr).

CVSS VectorVendor: zephyr

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 01:49 vuln.today

Analysis Generated

Jul 22, 2026 - 01:49 vuln.today

DescriptionCVE.org

The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the start of mcux_lpuart_configure(), which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards (in mcux_lpuart_configure_basic), and unsupported parity/data-bit/stop-bit/flow-control values return -ENOTSUP before the clock is re-enabled.

As a result, a uart_configure() request with an unsupported configuration left the LPUART in a clock-disabled state; any subsequent access to LPUART registers (poll_out/poll_in, interrupt handling, or a later reconfigure) faults on the gated peripheral and escalates to a hard fault, crashing the system.

uart_configure() is a Zephyr syscall whose verifier (z_vrfy_uart_configure) only checks that cfg is readable user memory and forwards the caller-supplied configuration unchanged, so an unprivileged userspace thread with access to an LPUART device can deterministically trigger the fault, a persistent system-wide denial of service.

Introduced in v2.5.0 and present in all subsequent releases until this fix, which removes the LPUART_Deinit() call and instead only disables the transmitter/receiver, leaving the clock running.

AnalysisAI

Persistent denial of service in the NXP LPUART serial driver for Zephyr RTOS allows an unprivileged userspace thread to deterministically crash the entire embedded system by issuing a uart_configure() call with an unsupported parameter value while CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled. The driver's configure path calls LPUART_Deinit() before validating the requested configuration, gating the peripheral clock; if validation then rejects the parameters, the clock is never restored, and any subsequent LPUART register access - from any thread or interrupt handler - triggers a hard fault and system reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fault path is trivially and deterministically reproducible from userspace on affected NXP MCU targets.

Technical ContextAI

The vulnerability resides in drivers/serial/uart_mcux_lpuart.c in the Zephyr RTOS, which targets NXP MCUs using the LPUART peripheral (e.g., i.MX RT, LPC, Kinetis families). CWE-617 (Reachable Assertion / improper error-path state management) is the root cause class: the mcux_lpuart_configure() function calls the NXP SDK's LPUART_Deinit() as the first step of reconfiguration, which disables the peripheral's clock gating. Parameter validation occurs afterward in mcux_lpuart_configure_basic(); if the supplied parity, data-bit, stop-bit, or flow-control value is unsupported, the function returns -ENOTSUP before re-enabling the clock. With clocks gated, the LPUART register aperture becomes inaccessible; any subsequent bus access faults on the MCU's bus fabric and Zephyr escalates this to a hard fault, typically causing a full system reset. The Zephyr syscall verifier z_vrfy_uart_configure performs only a pointer-readability check on the cfg argument and forwards caller-supplied values unchanged, making this error path reachable from any unprivileged Zephyr userspace thread that holds a file descriptor or device permission for an LPUART node. CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*.

RemediationAI

The upstream fix is confirmed available as commit f56935c46fdf6559a20ad8484b29896ecac5808f in the Zephyr project repository (https://github.com/zephyrproject-rtos/zephyr/commit/f56935c46fdf6559a20ad8484b29896ecac5808f); it replaces the LPUART_Deinit() call with targeted transmitter/receiver disable (clearing LPUART_CTRL_TE_MASK and LPUART_CTRL_RE_MASK), leaving clock gating intact throughout the configure path. Teams should upgrade to Zephyr 4.5.0 or later, or backport this single-file commit to their in-tree driver for earlier release branches. If an immediate upgrade is not feasible, disabling CONFIG_UART_USE_RUNTIME_CONFIGURE in the project Kconfig prevents the vulnerable code path from being compiled entirely - note this trades away the ability to change UART parameters at runtime without a rebuild. A secondary compensating control is to restrict unprivileged thread access to LPUART device nodes via Zephyr's device permission APIs, ensuring only trusted kernel-mode code can call uart_configure(); this does not fix the bug but eliminates the userspace trigger path. A released patched version number beyond 4.5.0 has not been independently confirmed from the available data; verify the exact target tag in the Zephyr changelog.