CVE-2026-10683
Awaiting Analysis Awaiting Analysis - Queue

I2C Target Write Request Deadlock in Synopsys DesignWare Driver

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Zephyr Project

Description
In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START, was never added to the enabled interrupt mask in i2c_dw_slave_register(), so that recovery path was dead code. As a result, if the STOP interrupt is lost (bus glitch/reset, or a concurrent master driving STOP) or the bus master issues a legal WRITE-repeated-START-WRITE sequence with the same direction, the driver remains in CMD_SEND permanently and never invokes write_requested() again for the life of the target. An I2C master on the same physical bus can deliberately trigger this, causing the I2C target function to malfunction for all subsequent write transactions and desynchronizing consumer framing state (e.g. MCTP-over-I2C), a recoverable-by-reset denial of service of the target peripheral. The fix unmasks START_DET so the state is reset at every bus (re)START. Impact is availability-only over a local board-level bus; no memory corruption results in the in-tree consumer, whose per-byte buffer write is independently bounds-checked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-10683
EUVD
EUVD-2026-49399

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
synopsys designware_i2c_driver *
synopsys designware_i2c_driver to 4.4.0 (exc)
synopsys designware_i2c_driver From 4.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Synopsys DesignWare I2C driver in Zephyr RTOS when operating in target/slave mode. The driver's state machine can get stuck in the CMD_SEND state if the STOP interrupt is lost or if a repeated START with the same direction occurs. This happens because the write_requested() callback depends on the state not being CMD_SEND, and the state only resets to READY on a STOP interrupt. The START_DET interrupt, which would reset the state on every START, was not enabled, making recovery impossible.

Detection Guidance

This vulnerability is specific to the Synopsys DesignWare I2C driver in Zephyr RTOS operating in target/slave mode. Detection requires checking if the I2C target function becomes unresponsive to write transactions or if the driver's state machine gets stuck in CMD_SEND. Monitor for repeated write transaction failures or desynchronized framing state (e.g., MCTP-over-I2C). No direct network commands apply; inspect system logs for I2C driver errors or unexpected behavior.

Impact Analysis

An attacker on the same physical bus can deliberately trigger this issue, causing the I2C target to malfunction for all subsequent write transactions. This leads to a denial-of-service condition where the target peripheral becomes unresponsive until reset. It may also desynchronize consumer framing state, such as MCTP-over-I2C, disrupting communication.

Compliance Impact

This vulnerability primarily impacts system availability on a local board-level bus and does not involve memory corruption or data integrity issues. It is unlikely to directly affect compliance with standards like GDPR or HIPAA, which focus on data protection and privacy. The denial-of-service condition is localized and recoverable by reset, with no evidence of unauthorized data access or exposure.

Mitigation Strategies

Apply the provided patch to enable the START_DET interrupt mask in the I2C DesignWare driver. Update to Zephyr RTOS version 4.4.0 or later where the fix is included. If immediate patching is not possible, consider disabling I2C target mode on affected systems or isolating the bus to prevent malicious triggering of the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10683. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart