Zephyr RTOS EUVD-2026-39106

Exploitation requires both of the following conditions simultaneously: (1) CTS hardware flow control must be enabled on the PL011 UART instance, configured either statically via the devicetree hw-flow-control property or dynamically at runtime via UART_CFG_FLOW_CTRL_RTS_CTS - this is not the default in many Zephyr configurations; and (2) the attacker must be able to de-assert the CTS signal on the physical UART CTS pin, either by controlling the wired peer device directly or by compromising firmware on that device. The Zephyr build must be v4.1.0 through v4.4.0 running on hardware with a PL011 UART peripheral. Exploitation is not possible if CTS flow control is disabled, if the CTS line is unconnected or held asserted, or if the system runs a Zephyr version outside the v4.1.0-v4.4.0 range. The attack cannot be launched remotely over any network; physical or hardware-adjacent access to the UART bus is mandatory, and this is the primary limiting factor for defenders assessing realistic exposure.

The reported CVSS 3.1 score of 6.5 uses vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, but the Adjacent-Network designation merits scrutiny: triggering the hang requires direct electrical control of the UART CTS hardware line, which is arguably an AV:P (Physical) scenario rather than a network-adjacent one. This means real-world exploitability is more constrained than the score implies. No EPSS data was provided, and the vulnerability does not appear in the CISA KEV catalog; no public exploit code has been identified. The practical attack population is further limited by the non-default prerequisite that CTS hardware flow control must be explicitly enabled. Despite the absence of weaponized exploits, the hang is deterministic and requires no special knowledge once an attacker has the necessary physical access. The availability-only impact reduces urgency for most deployments, but systems where UART continuity is safety-critical - particularly Bluetooth HCI H4 stacks layered over UART - face complete transport-layer stalls with no recovery short of a reset.

An attacker who has physical control of - or has compromised - a device wired to the UART CTS pin of a Zephyr v4.1.0-v4.4.0 system (for example, a Bluetooth module connected via HCI H4 over UART with CTS flow control enabled) simply holds the CTS line de-asserted while the Zephyr host initiates a transmission. The pl011_irq_tx_enable() loop spins indefinitely, permanently blocking the transmitting thread and stalling the UART transport layer; no exploit code or elevated privilege is required beyond physical or logical control of the CTS signal.