CVE-2026-10683

Name of the Vulnerable Software and Affected Versions Synopsys DesignWare I2C driver (affected versions not specified)

Description When operating in target/slave mode, the rx full interrupt handler restricts the write requested() callback based on the dw->state variable. Because the START DET interrupt was not included in the enabled interrupt mask within the i2c dw slave register() function, the driver fails to reset its state during a (re)START sequence. Consequently, if a STOP interrupt is lost due to a bus glitch or if a master performs a WRITE-repeated-START-WRITE sequence, the driver remains stuck in the CMD SEND state. This prevents the write requested() function from being invoked again, allowing a local I2C master to cause a denial of service by desynchronizing the framing state and malfunctioning subsequent write transactions.

Recommendations Unmask the START DET interrupt to ensure the state is reset at every bus (re)START.