CVE-2026-10673 zephyrproject CVE debrief

Who should care

Users of Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver, especially those with systems exposed to single-pair Ethernet segments, should assess their exposure and prioritize patching or mitigation. This involves reviewing network configurations, identifying potentially vulnerable systems, and coordinating with relevant teams to apply necessary patches or workarounds. Additionally, users should monitor for suspicious activity and be prepared to respond to potential security incidents related to this vulnerability. Affected operators, platform administrators, vulnerability management teams, and security teams should collaborate to ensure timely remediation and minimize potential impact. This may involve updating asset inventories, adjusting security controls, and verifying the effectiveness of compensating controls. Effective communication and coordination among these stakeholders are crucial to mitigating the risks associated with this vulnerability. Users should also consider implementing compensating controls, such as network segmentation or enhanced monitoring, to reduce the attack surface and detect potential exploitation attempts. By taking these steps, users can help protect their systems and data from potential exploitation of this vulnerability. Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver users must verify their configurations and apply patches or mitigations as needed to prevent potential security breaches. This requires a thorough understanding of the vulnerability, its potential impact, and the necessary remediation steps. Users should also be aware of potential limitations or challenges in applying patches or mitigations and plan accordingly to minimize disruptions to their operations. In addition, users should review their incident response plans to ensure they are prepared to respond to potential security incidents related to this vulnerability. This includes identifying key stakeholders, defining response procedures, and establishing communication channels. By being proactive and taking these steps, users can help minimize the risks associated with this vulnerability and protect their systems and data from potential exploitation

Technical summary

The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer. An attacker on the single-pair Ethernet segment can send a frame whose reassembled size exceeds the configured buffer, causing the driver's RX offload thread to write attacker-controlled frame bytes past the end of the static buffer into adjacent driver/kernel memory. This is a remotely/adjacently reachable out-of-bounds write (CWE-787) that can corrupt memory and cause denial of service or potentially code execution.

Defensive priority

High priority due to remotely/adjacently reachable out-of-bounds write vulnerability

Recommended defensive actions

• Apply patches from vendor
• Restrict access to affected systems
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The defect was introduced when OA SPI support was added (commit 0ca8b0756b1) and shipped in releases v3.7.0 through v4.4.0. The fix adds a bounds check that drops the oversized frame and resets the cursor before the copy.

Official resources