The Pl011 UART driver in Zephyr contains an unbounded loop in pl011_irq_tx_enable() that repeatedly calls the interrupt‑driven callback as long as the TX interrupt mask remains set. When CTS hardware flow control is active and the peer de‑asserts CTS, the controller stops draining the FIFO, causing pl011_fifo_fill() to return zero and the loop condition never to clear. As a result, the calling thread spins indefinitely, hanging the execution context and stalling the transport, achieving a classic denial‑of‑service condition. The flaw is purely an availability issue; it does not affect memory safety, confidentiality, or integrity.

This vulnerability affects Zephyr RTOS releases from v4.1.0 through v4.4.0, inclusive. The flaw was introduced in a February 2025 commit and is present in all builds that include the affected code without the later patch.

The CVSS score of 6.5 indicates moderate severity, and EPSS data is not available, so the current exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker who can control the UART's CTS line, which implies physical or low‑level access to the embedded system. Once CTS is de‑asserted during transmission, the driver will hang until CTS is re‑asserted, leading to a loss of availability for the affected UART channel.