CVE-2026-10683 zephyrproject CVE debrief

Who should care

Users of the Synopsys DesignWare I2C driver operating in target/slave mode should be aware of this vulnerability and take steps to mitigate its impact. This includes ensuring proper bus management, monitoring for potential bus glitches or resets, and applying the patch provided by the vendor.

Technical summary

The Synopsys DesignWare I2C driver operating in target/slave mode is vulnerable to a denial-of-service attack. The vulnerability is caused by the rx_full interrupt handler gating the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. An I2C master on the same physical bus can deliberately trigger this, causing the I2C target function to malfunction for all subsequent write transactions.

Defensive priority

The target peripheral can be protected by ensuring proper bus management and monitoring for potential bus glitches or resets. Implementing compensating controls, such as reset mechanisms, can also help mitigate the impact of this vulnerability.

Recommended defensive actions

• Implement monitoring to detect potential bus glitches or resets
• Ensure proper bus management to prevent exploitation
• Apply the patch provided by the vendor to unmask the START_DET interrupt
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the rx_full interrupt handler gating the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, which would reset the state on every (re)START, is not enabled in the interrupt mask.

Official resources