CVE-2026-10673

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Zephyr RTOS ADIN2111/ADIN1110 Ethernet Driver

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: Zephyr Project

Description

The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes). In eth_adin2111_oa_data_read(), each valid chunk was memcpy'd into ctx->buf[ctx->scur] and the write cursor scur advanced, with no check that scur + len stayed within the buffer. The number of chunks (up to 255, from the BUFSTS RCA field) and the per-chunk length are taken entirely from the frame data received off the wire; the cursor is only reset on a start-of-frame chunk. An attacker on the single-pair Ethernet segment can therefore send a frame whose reassembled size exceeds the configured buffer, causing the driver's RX offload thread to write attacker-controlled frame bytes past the end of the static buffer into adjacent driver/kernel memory (up to roughly 14.8 KB in the worst case). This is a remotely/adjacently reachable out-of-bounds write (CWE-787) that can corrupt memory and cause denial of service or potentially code execution. The defect was introduced when OA SPI support was added (commit 0ca8b0756b1) and shipped in releases v3.7.0 through v4.4.0. The fix adds a bounds check that drops the oversized frame and resets the cursor before the copy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-10673

EUVD

EUVD-2026-44746

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	From 3.7.0 (inc) to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a remotely exploitable out-of-bounds write in the Zephyr RTOS Ethernet driver for ADIN2111/ADIN1110 devices operating in OPEN Alliance (OA) SPI mode. The driver reassembles received Ethernet frames by copying 64-byte chunks into a fixed static buffer without validating if the total frame size exceeds the buffer limit. An attacker on the Ethernet segment can send a maliciously crafted frame that causes the driver to write beyond the buffer into adjacent memory, potentially corrupting critical structures and leading to denial of service or code execution.

Detection Guidance

Detecting this vulnerability requires checking Zephyr RTOS versions and Ethernet driver configurations. Inspect your system for Zephyr versions between 3.7.0 and 4.4.0 running ADIN2111/ADIN1110 in OPEN Alliance SPI mode. Check if CONFIG_ETH_ADIN2111_BUFFER_SIZE is set to 1524 bytes. Monitor logs for buffer overflow errors during Ethernet frame processing.

Impact Analysis

This vulnerability allows an attacker on the same Ethernet segment to remotely trigger memory corruption by sending specially crafted packets. This could lead to system crashes (denial of service), unauthorized memory access, or potentially code execution with the privileges of the affected driver. Systems using vulnerable Zephyr versions in OA SPI mode are at risk if exposed to untrusted network segments.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data corruption, which may violate integrity and availability requirements in GDPR, HIPAA, and other standards. If exploited, it could result in unauthorized access to sensitive data or system disruption, potentially leading to compliance breaches and regulatory penalties.

Mitigation Strategies

Immediately update Zephyr RTOS to a patched version (4.4.1 or later) or apply the upstream commits c98321cbf and 158df8d08. Disable OPEN Alliance SPI mode if not required. Increase buffer sizes to 255*68 bytes for OA SPI transfers. Monitor network traffic for malformed Ethernet frames targeting ADIN2111 devices.

Hi! I’m here to help you understand CVE-2026-10673. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70