CVE-2026-10673
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes). In eth_adin2111_oa_data_read(), each valid chunk was memcpy'd into ctx->buf[ctx->scur] and the write cursor scur advanced, with no check that scur + len stayed within the buffer. The number of chunks (up to 255, from the BUFSTS RCA field) and the per-chunk length are taken entirely from the frame data received off the wire; the cursor is only reset on a start-of-frame chunk. An attacker on the single-pair Ethernet segment can therefore send a frame whose reassembled size exceeds the configured buffer, causing the driver's RX offload thread to write attacker-controlled frame bytes past the end of the static buffer into adjacent driver/kernel memory (up to roughly 14.8 KB in the worst case). This is a remotely/adjacently reachable out-of-bounds write (CWE-787) that can corrupt memory and cause denial of service or potentially code execution. The defect was introduced when OA SPI support was added (commit 0ca8b0756b1) and shipped in releases v3.7.0 through v4.4.0. The fix adds a bounds check that drops the oversized frame and resets the cursor before the copy.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe Zephyr ADIN2111/ADIN1110 Ethernet driver has an out-of-bounds write vulnerability (CWE-787) in its OPEN Alliance SPI frame reassembly logic. The driver copies device-supplied 64-byte chunks into a fixed 1524-byte buffer (ctx->buf) without checking if the write cursor (scur) plus chunk length exceeds the buffer boundary. Since the chunk count (up to 255) and per-chunk lengths are attacker-controlled values from received frame data, an adjacent attacker can send frames exceeding the buffer size, causing writes of up to ~14.8 KB past the buffer end into adjacent memory.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 3.7.0, < 4.5.0CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Adjacent
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Zephyr RTOS usageCheck firmware/build system for Zephyr RTOS (look for zephyr.ld linker script, zephyr/cmake subsystem, or Kconfig files in the build)Affected if The device runs Zephyr RTOS as its embedded operating system
-
Verify ADIN2111/ADIN1110 driver is enabledInspect build configuration (Kconfig, defconfig, or .conf files) for CONFIG_ETH_ADIN1110 or CONFIG_ETH_ADIN2111 being set to yAffected if Either CONFIG_ETH_ADIN1110 or CONFIG_ETH_ADIN2111 is enabled in the build configuration
-
Confirm OPEN Alliance SPI handling is activeCheck if CONFIG_ETH_ADIN1110_OPENAlliance or similar SPI frame reassembly option is enabled in the build configAffected if The OPEN Alliance SPI frame reassembly feature is compiled into the driver
-
Determine Zephyr versionCheck the zephyr/version.h file, or the Kconfig file for CONFIG_ZEPHYR_VERSION, or inspect the Zephyr SDK release tag in the build environmentAffected if The Zephyr version is prior to when the bounds-checking patch was applied (compare against vendor release notes for the fix)
-
Inspect driver source for bounds checkReview the adin1110.c or adin2111.c source file in the Zephyr tree, looking for the frame reassembly function that copies chunks into ctx->buf; verify if there is a bounds check comparing scur + chunk_len against the buffer size before the memcpy callAffected if The source code lacks proper bounds checking before copying frame data into the 1524-byte buffer, allowing the out-of-bounds write condition
A device is affected if it runs Zephyr with the ADIN2111/ADIN1110 Ethernet driver enabled, uses the OPEN Alliance SPI frame reassembly feature, and lacks the bounds-checking patch in the driver code.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped4.5.0
Apply the vendor patch that adds bounds checking to drop oversized frames and reset the cursor before copying. Until patched, restrict physical access to the single-pair Ethernet segment to prevent adjacent attackers.
Zephyr v4.5.0 or later (or the release containing the bounds check patch for this vulnerability)
- 1. Identify the current Zephyr RTOS version in use by checking the manifest or version file in your project (e.g., west.yml or zephyr/version.h)
- 2. If running v3.7.0 through v4.4.0, upgrade to Zephyr v4.5.0 or later which contains the bounds check fix
- 3. Rebuild and flash the firmware with the updated Zephyr version
- 4. Verify the fix is present by checking the eth_adin2111.c file in the new version for the bounds check in eth_adin2111_oa_data_read() function
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing8.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,864.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-10673 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-10673 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data