{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-10642 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-10642 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-10642 is a medium-severity denial of service vulnerability in Zephyrproject Zephyr, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-10642 and fix it if it is affected.\n\nWhat it is: CVE-2026-10642 is a medium-severity denial of service vulnerability in Zephyrproject Zephyr, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-10642 in the wild and no public exploit code.\n\nAffected product: Zephyrproject Zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-10642/ (Markdown: https://insights.sbomify.com/CVE-2026-10642/index.md)","id":"CVE-2026-10642","markdown":"https://insights.sbomify.com/CVE-2026-10642/index.md","name":"CVE-2026-10642","record":{"aliases":["GHSA-3fgh-73jh-2q5j"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Zephyr RTOS","requires_auth":"none","summary":"An attacker with adjacent access can cause a denial of service in Zephyr RTOS by withholding CTS signals during UART transmission, triggering an infinite loop.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[{"product":"zephyr","vendor":"zephyrproject"}],"cvss":{"score":4.6,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"}],"description":"The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the interrupt-driven application callback while the TX interrupt mask bit (PL011_IMSC_TXIM) is set, to work around the controller's level-transition TX-interrupt behavior.\n\nWhen CTS hardware flow control is enabled (devicetree hw-flow-control or runtime UART_CFG_FLOW_CTRL_RTS_CTS) and the wired serial peer de-asserts CTS, the controller stops draining the TX FIFO; pl011_fifo_fill() then returns 0 on every call while the application still has pending data and therefore never disables the TX interrupt. The loop condition never clears, so the thread that called uart_irq_tx_enable() (e.g. h4_send() in the Bluetooth HCI H4 driver) spins indefinitely, hanging the executing context and stalling the transport — a denial of service (CWE-835).\n\nAn attacker controlling the device attached to the UART's CTS line can trigger the hang by withholding CTS during transmission. Because that peer is the device wired to the UART — which may be a removable or external module (e.g. an off-board Bluetooth controller on the HCI H4 link) rather than a permanently-bonded on-PCB part — the attack vector is scored Adjacent (AV:A) rather than Physical; the security subcommittee should confirm the vector against the specific deployment. Impact is availability only; there is no memory-safety, confidentiality, or integrity consequence.\n\nThe vulnerable loop was introduced in commit b783bc8448ef (Feb 2025) and shipped in releases v4.1.0 through v4.4.0. The fix breaks out of the loop when CTS is blocking and arms the CTS modem-status interrupt to resume transmission when CTS re-asserts.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control","id":"CVE-2026-10642","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"zephyrproject:zephyr","products":["zephyrproject:zephyr"],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Memory corruption in zephyr","id":"CVE-2026-10643"},"packages":[],"prev":{"headline":"Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values)","id":"CVE-2026-10641"},"products":["zephyr"],"published":"2026-06-24","related":[{"cvss_score":9.8,"headline":"Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key","id":"CVE-2026-5067","kev_date_added":null,"published":"2026-06-09"},{"cvss_score":9.8,"headline":"Bluetooth HCI Error Handling Double Free","id":"CVE-2022-3806","kev_date_added":null,"published":"2023-01-19"},{"cvss_score":9.8,"headline":"Memory corruption in getaddrinfo","id":"CVE-2017-14199","kev_date_added":null,"published":"2019-04-12"},{"cvss_score":9.8,"headline":"Null dereference in n/a","id":"CVE-2018-1000800","kev_date_added":null,"published":"2018-09-06"},{"cvss_score":9.6,"headline":"DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer","id":"CVE-2021-3329","kev_date_added":null,"published":"2023-02-26"},{"cvss_score":9.6,"headline":"DoS: Invalid Initialization in le_read_buffer_size_complete","id":"CVE-2023-0397","kev_date_added":null,"published":"2023-01-19"},{"cvss_score":9.6,"headline":"Usb bluetooth device ACL read cb buffer overflow","id":"CVE-2021-3966","kev_date_added":null,"published":"2023-01-11"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["zephyrproject"]},"summary":"An attacker with adjacent access can cause a denial of service in Zephyr RTOS by withholding CTS signals during UART transmission, triggering an infinite loop.","url":"https://insights.sbomify.com/CVE-2026-10642/"}