{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-12629 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-12629 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-12629 is a medium-severity denial of service vulnerability in zephyrproject zephyr, published on 17 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-12629 and fix it if it is affected.\n\nWhat it is: CVE-2026-12629 is a medium-severity denial of service vulnerability in zephyrproject zephyr, published on 17 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-12629 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-12629/ (Markdown: https://insights.sbomify.com/CVE-2026-12629/index.md)","id":"CVE-2026-12629","markdown":"https://insights.sbomify.com/CVE-2026-12629/index.md","name":"CVE-2026-12629","record":{"aliases":["GHSA-36rp-2hcp-f5hv"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Zephyr RTOS UART driver","requires_auth":"none","summary":"An attacker controlling a serial peer can cause a permanent system hang in Zephyr RTOS by triggering uncleared UART error interrupts, requiring explicit error interrupt enablement.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":4.6,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"}],"description":"The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrupts. On the PL011, the framing, parity, break, and overrun error interrupts (PL011_IMSC_ERROR_MASK) are cleared only by writing the interrupt-clear register UARTICR; reading the data register clears the RX interrupt and the per-byte RSR status but not the error interrupt status in MIS. The interrupt service routine pl011_isr() acknowledged only the CTS modem-status interrupt and never wrote icr for the error bits, so an asserted error interrupt remains pending after the ISR returns.\n\nWhen an application enables error-interrupt reporting via the public uart_irq_err_enable() API, an attacker who controls the serial peer can deterministically assert these error bits by injecting line errors on the RX line — a baud/stop-bit mismatch or mid-character break (framing/break error), a flipped parity bit (parity error), or FIFO flooding (overrun error). Because the error interrupt is never cleared, the interrupt line stays asserted and the CPU re-enters pl011_isr() immediately and indefinitely, producing an interrupt-storm livelock from which the core makes no forward progress.\n\nThe impact is an availability-only denial of service (permanent hang), reachable from an external or removable UART peer. Exploitation is gated by configuration: the error interrupt is off by default and no in-tree subsystem enables it, so only applications that explicitly call uart_irq_err_enable() on a PL011-based, interrupt-driven port are affected. The fix makes pl011_isr() acknowledge the pending error bits via uart-\u003eicr, breaking the loop, and additionally clears the latched RSR status in pl011_err_check().","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service","id":"CVE-2026-12629","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode","id":"CVE-2026-12630"},"packages":[],"prev":{"headline":"Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system","id":"CVE-2026-12628"},"products":["zephyr"],"published":"2026-08-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-17","vendors":["zephyrproject"]},"summary":"An attacker controlling a serial peer can cause a permanent system hang in Zephyr RTOS by triggering uncleared UART error interrupts, requiring explicit error interrupt enablement.","url":"https://insights.sbomify.com/CVE-2026-12629/"}