PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12629 zephyrproject CVE debrief

The ARM PL011 UART driver fails to acknowledge receive error interrupts, leading to a denial-of-service condition. An attacker can inject line errors to cause an interrupt storm, making the system hang. This issue affects applications that enable error-interrupt reporting via uart_irq_err_enable() on PL011-based, interrupt-driven ports. The error interrupt is off by default and no in-tree subsystem enables it. To mitigate, review and apply the patch from the Zephyr project, disable error-interrupt reporting if not required, and monitor system logs for interrupt storm conditions. Ensure system configurations are reviewed and necessary actions are taken to protect systems.

Vendor
zephyrproject
Product
zephyr
CVSS
MEDIUM 4.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-17
Original CVE updated
2026-08-26
Advisory published
2026-08-17
Advisory updated
2026-08-26

Who should care

Users of the Zephyr project with PL011-based, interrupt-driven ports and applications that enable error-interrupt reporting should review their configurations and consider applying mitigations. System administrators and security teams responsible for maintaining systems that use the Zephyr project should also be aware of this vulnerability and take necessary actions to protect their systems.

Technical summary

The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts, leading to a denial-of-service condition. An attacker can inject line errors to cause an interrupt storm, making the system hang. The error interrupt is off by default and no in-tree subsystem enables it, so only applications that explicitly call uart_irq_err_enable() on a PL011-based, interrupt-driven port are affected.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the patch from the Zephyr project
  • Disable error-interrupt reporting if not required
  • Monitor system logs for interrupt storm conditions
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Zephyr project has a commit and advisory related to this issue. Further review of the Zephyr project's documentation and code changes is recommended to understand the full scope of the vulnerability and potential mitigations. Additionally, defenders should verify if their systems are using the affected PL011 UART driver and if error-interrupt reporting is enabled.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-12629 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-12629

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-12629 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-12629

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.