Executive brief
A vulnerability exists in the Ethernet driver for certain networking chips used by the Zephyr operating system. An attacker on the same local network segment can send specially crafted network traffic that causes the system to crash or potentially execute unauthorized code. This could lead to a complete loss of service or allow an attacker to gain control over the affected device.
Technical details
The vulnerability consists of two distinct issues within the ADIN2111/ADIN1110 Ethernet driver (eth_adin2111.c). First, the driver fails to perform bounds checking when reassembling Ethernet frames from 64-byte SPI chunks into a static buffer (ctx->buf), allowing a write cursor (scur) to advance beyond the buffer's 1524-byte limit. Second, the SPI transfer buffers (oa_tx_buf and oa_rx_buf) were undersized at 16320 bytes, failing to account for the 4-byte header per 64-byte chunk, which allows for an additional overflow of up to 1020 bytes during DMA transfers. An unauthenticated attacker on the same single-pair Ethernet segment can exploit these by sending large frames, resulting in an out-of-bounds write (CWE-787) of up to 14.8 KB into adjacent driver or kernel memory. Patches have been released to add bounds checking and correctly size the SPI buffers.
Affected products
- Zephyr Project Zephyr RTOS v3.7.0 through v4.4.0
Timeline
- 2026-07-15: advisory: Project advisory GHSA-hm6v-4jh4-3qc4 published
- 2026-07-15: disclosed: CVE-2026-10673 published to NVD
References
- https://github.com/zephyrproject-rtos/zephyr
- https://github.com/zephyrproject-rtos/zephyr/commit/158df8d088316cdae20816fc07703892280b2acb
- https://github.com/zephyrproject-rtos/zephyr/commit/c98321cbfef23c0e3bdf043ccf6b421067c8d508
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hm6v-4jh4-3qc4