CVE-2026-10683: dos in zephyrproject zephyr
In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START, was never added to the enabled interrupt mask in i2c_dw_slave_register(), so that recovery path was dead code. As a result, if the STOP interrupt is lost (bus glitch/reset, or a concurrent master driving STOP) or the bus master issues a legal WRITE-repeated-START-WRITE sequence with the same direction, the driver remains in CMD_SEND permanently and never invokes write_requested() again for the life of the target. An I2C master on the same physical bus can deliberately trigger this, causing the I2C target function to malfunction for all subsequent write transactions and desynchronizing consumer framing state (e.g. MCTP-over-I2C), a recoverable-by-reset denial of service of the target peripheral. The fix unmasks START_DET so the state is reset at every bus (re)START. Impact is availability-only over a local board-level bus; no memory corruption results in the in-tree consumer, whose per-byte buffer write is independently bounds-checked.
AI Analysis
Technical Summary
The vulnerability exists in the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) when operating in target/slave mode. The rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, but dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt handler, which would reset the state on every (re)START, was never enabled, leaving that recovery path inactive. Consequently, if the STOP interrupt is lost or a WRITE-repeated-START-WRITE sequence with the same direction occurs, the driver remains stuck in CMD_SEND state, preventing further write_requested() callbacks. This causes the I2C target function to malfunction for subsequent write transactions and desynchronizes consumer framing state, resulting in a denial of service that requires a reset to recover. The fix involves enabling the START_DET interrupt to reset the state at every bus (re)START. The impact is limited to availability on a local board-level bus with no memory corruption.
Potential Impact
An I2C master on the same physical bus can deliberately trigger this vulnerability to cause the I2C target peripheral to malfunction for all subsequent write transactions. This results in a denial of service condition that affects availability only and is recoverable by resetting the target device. There is no impact on confidentiality or integrity, and no memory corruption occurs.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix unmasks the START_DET interrupt so the driver state resets on every bus (re)START. Until a patch is available, affected systems should consider hardware or firmware resets to recover from this condition if it occurs.
CVE-2026-10683: dos in zephyrproject zephyr
Description
In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START, was never added to the enabled interrupt mask in i2c_dw_slave_register(), so that recovery path was dead code. As a result, if the STOP interrupt is lost (bus glitch/reset, or a concurrent master driving STOP) or the bus master issues a legal WRITE-repeated-START-WRITE sequence with the same direction, the driver remains in CMD_SEND permanently and never invokes write_requested() again for the life of the target. An I2C master on the same physical bus can deliberately trigger this, causing the I2C target function to malfunction for all subsequent write transactions and desynchronizing consumer framing state (e.g. MCTP-over-I2C), a recoverable-by-reset denial of service of the target peripheral. The fix unmasks START_DET so the state is reset at every bus (re)START. Impact is availability-only over a local board-level bus; no memory corruption results in the in-tree consumer, whose per-byte buffer write is independently bounds-checked.
CVSS v3.1
Score 2.4low
Affected software
zephyrproject
zephyr
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) when operating in target/slave mode. The rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, but dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt handler, which would reset the state on every (re)START, was never enabled, leaving that recovery path inactive. Consequently, if the STOP interrupt is lost or a WRITE-repeated-START-WRITE sequence with the same direction occurs, the driver remains stuck in CMD_SEND state, preventing further write_requested() callbacks. This causes the I2C target function to malfunction for subsequent write transactions and desynchronizes consumer framing state, resulting in a denial of service that requires a reset to recover. The fix involves enabling the START_DET interrupt to reset the state at every bus (re)START. The impact is limited to availability on a local board-level bus with no memory corruption.
Potential Impact
An I2C master on the same physical bus can deliberately trigger this vulnerability to cause the I2C target peripheral to malfunction for all subsequent write transactions. This results in a denial of service condition that affects availability only and is recoverable by resetting the target device. There is no impact on confidentiality or integrity, and no memory corruption occurs.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix unmasks the START_DET interrupt so the driver state resets on every bus (re)START. Until a patch is available, affected systems should consider hardware or firmware resets to recover from this condition if it occurs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:26:20.475Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a67a90c9c2644c7f8a59f16
Added to database: 07/27/2026, 18:53:00 UTC
Last enriched: 07/30/2026, 01:02:39 UTC
Last updated: 09/10/2026, 20:02:43 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.