CVE-2026-10673: Zephyr ADIN2111 Driver DOS Vulnerability

CVE-2026-10673 Overview

CVE-2026-10673 is an out-of-bounds write vulnerability in the Zephyr RTOS ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c). The driver reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf. The function eth_adin2111_oa_data_read() performs no bounds check before writing each chunk, allowing an attacker on the single-pair Ethernet segment to overflow the buffer by up to roughly 14.8 KB. The flaw affects Zephyr releases v3.7.0 through v4.4.0 and can lead to memory corruption, denial of service, or potentially code execution.

Critical Impact
An adjacent-network attacker can corrupt driver and kernel memory in Zephyr-based embedded devices using the ADIN2111/ADIN1110 Ethernet driver, enabling denial of service and potentially arbitrary code execution.

Affected Products

Zephyr RTOS v3.7.0 through v4.4.0
Devices using the eth_adin2111 driver in OPEN Alliance SPI mode
ADIN2111 and ADIN1110 10BASE-T1S/T1L Ethernet controllers integrated with Zephyr

Discovery Timeline

2026-07-15 - CVE-2026-10673 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-10673

Vulnerability Analysis

The Zephyr ADIN2111/ADIN1110 driver handles frame reassembly for OPEN Alliance (OA) SPI mode by accumulating 64-byte chunks delivered from the MAC-PHY controller. Each chunk is copied into the static buffer ctx->buf, sized by CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes). The write cursor ctx->scur advances after each memcpy, but the driver never verifies that scur + len remains within buffer bounds.

The number of chunks is read from the BUFSTS RCA field and can reach 255. The per-chunk length is derived from frame data received off the wire. The cursor resets only on a start-of-frame chunk, so an attacker who never asserts start-of-frame can drive scur well beyond the buffer end. The driver's RX offload thread then writes attacker-controlled bytes into adjacent driver and kernel memory. Worst-case overflow reaches roughly 14.8 KB.

Root Cause

The defect is a missing bounds check in the frame reassembly path of eth_adin2111_oa_data_read(). The function trusts device-supplied length and chunk-count fields without validating them against the fixed static destination buffer. This is classified as CWE-787 (Out-of-Bounds Write). The regression was introduced in commit 0ca8b0756b1 when OA SPI support was added.

Attack Vector

Exploitation requires access to the single-pair Ethernet (10BASE-T1S or 10BASE-T1L) segment attached to the target device. The attacker crafts a frame whose reassembled size exceeds CONFIG_ETH_ADIN2111_BUFFER_SIZE, then transmits it on the shared bus. No authentication or user interaction is required. The malformed frame is processed by the RX offload thread, which performs the out-of-bounds memcpy with attacker-controlled content.

		len = (ftr & ADIN2111_OA_DATA_FTR_EV) ?
		       ((ftr & ADIN2111_OA_DATA_FTR_EBO_MSK) >> ADIN2111_OA_DATA_FTR_EBO) + 1 :
		       ctx->oa_cps;
+
+		if (ctx->scur + len > CONFIG_ETH_ADIN2111_BUFFER_SIZE) {
+			ctx->scur = 0;
+			LOG_ERR("OA RX: Frame is larger than maximum size !");
+			goto update_pos;
+		}
+
		memcpy(&ctx->buf[ctx->scur], &ctx->oa_rx_buf[rx_pos], len);
		ctx->scur += len;

Source: Zephyr commit 158df8d - the added bounds check drops oversized frames and resets the cursor before the copy.

Detection Methods for CVE-2026-10673

Indicators of Compromise

Log entries containing OA RX: Frame is larger than maximum size ! from patched builds, indicating attempted oversized frames
Unexplained crashes, hangs, or kernel faults in Zephyr devices using the ADIN2111/ADIN1110 driver
Anomalously large or malformed frames observed on 10BASE-T1S/T1L segments

Detection Strategies

Instrument the driver to log frame reassembly sizes and count occurrences of frames approaching or exceeding CONFIG_ETH_ADIN2111_BUFFER_SIZE
Passively capture traffic on the single-pair Ethernet segment and flag frames with abnormal chunk counts or oversized reassembled payloads
Monitor Zephyr device telemetry for RX thread faults, watchdog resets, or memory integrity failures correlated with network activity

Monitoring Recommendations

Aggregate device serial or syslog output into a centralized log store and alert on driver error strings introduced by the patch
Baseline normal frame size distributions per network segment and alert on deviations
Track firmware version inventory to identify devices still running Zephyr v3.7.0 through v4.4.0

How to Mitigate CVE-2026-10673

Immediate Actions Required

Inventory embedded devices running Zephyr and identify those using the eth_adin2111 driver in OA SPI mode
Update affected devices to a Zephyr release containing commits 158df8d088316cdae20816fc07703892280b2acb and c98321cbfef23c0e3bdf043ccf6b421067c8d508
Restrict physical and logical access to 10BASE-T1S/T1L segments until firmware is patched

Patch Information

The fix consists of two commits in the Zephyr project. Commit 158df8d adds a bounds check that drops the oversized frame and resets the cursor before the memcpy in eth_adin2111_oa_data_read(). Commit c98321c corrects the OA buffer sizing constant ADIN2111_OA_BUF_SZ from 255U * 64U to 255U * 68U. Additional context is available in the Zephyr GitHub Security Advisory GHSA-hm6v-4jh4-3qc4.

Workarounds

Segment the single-pair Ethernet bus so that only trusted devices can transmit on it
Where feasible, disable OA SPI mode on the ADIN2111/ADIN1110 and use generic SPI mode until firmware is updated
Apply the upstream patch as a local fix if a full Zephyr upgrade is not immediately possible

bash

# Rebuild Zephyr with the patched driver
cd zephyr
git fetch origin
git cherry-pick 158df8d088316cdae20816fc07703892280b2acb
git cherry-pick c98321cbfef23c0e3bdf043ccf6b421067c8d508
west build -b <your_board> <your_app>
west flash