The Zephyr PL011 UART driver contains an unbounded loop in pl011_irq_tx_enable() that repeatedly invokes the interrupt‑driven application callback while the TX interrupt mask bit remains set to compensate for the controller’s level‑transition TX‑interrupt behavior. When CTS hardware flow control is enabled and the connected peer de‑asserts CTS, the controller stops draining the TX FIFO, causing pl011_fifo_fill() to return zero on each call and the driver never clears the TX interrupt; the loop never ends. The thread that invoked uart_irq_tx_enable(), e.g. h4_send() in the Bluetooth HCI H4 driver, spins indefinitely, hanging the executing context and stalling the transport—a denial of service. An attacker who can control the UART’s CTS line can trigger this hang by withholding CTS; because the serial peer is often an external or removable module, the attack vector is adjacent (AV:A). The flaw impacts only availability; there is no memory‑safety, confidentiality, or integrity consequence, and it is a CWE‑835 unbounded or infinite loop.

This vulnerability affects Zephyr RTOS releases from v4.1.0 through v4.4.0, inclusive. The flaw was introduced in a February 2025 commit and is present in all builds that include the affected code without the later patch.

The CVSS score of 4.6 indicates low severity, and the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker who controls the UART’s CTS line can trigger the hang by withholding CTS; the attack vector is documented as Adjacent (AV:A). Once CTS is de‑asserted during transmission, the driver will hang until CTS is re‑asserted, resulting in a loss of availability for the affected UART channel.