CVE-2026-10673

Name of the Vulnerable Software and Affected Versions Zephyr versions 3.7.0 through 4.4.0

Description The ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver in drivers/ethernet/eth adin2111.c contains an out-of-bounds write issue when reassembling Ethernet frames in OPEN Alliance (OA) SPI mode. The driver copies 64-byte data chunks into a fixed static buffer ctx->buf using the eth adin2111 oa data read() function. Because the driver fails to verify if the write cursor scur plus the data length exceeds the buffer size CONFIG ETH ADIN2111 BUFFER SIZE, an attacker on the Ethernet segment can send a frame that exceeds the buffer capacity. This allows the RX offload thread to write attacker-controlled data into adjacent driver or kernel memory, potentially leading to memory corruption, denial of service, or code execution.

Recommendations Update Zephyr to a version later than 4.4.0. As a temporary mitigation, restrict access to the Ethernet segment to prevent unauthorized devices from sending oversized frames to the driver.