Skip to main content
EPSS 0.2%top 88%

CVE-2026-10683: dos in zephyrproject zephyr

0
Low
VulnerabilityCVE-2026-10683cvecve-2026-10683
Published: 07/27/2026 (07/27/2026, 18:30:49 UTC)
Source: CVE Database V5
Vendor/Project: zephyrproject
Product: zephyr

Description

In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START, was never added to the enabled interrupt mask in i2c_dw_slave_register(), so that recovery path was dead code. As a result, if the STOP interrupt is lost (bus glitch/reset, or a concurrent master driving STOP) or the bus master issues a legal WRITE-repeated-START-WRITE sequence with the same direction, the driver remains in CMD_SEND permanently and never invokes write_requested() again for the life of the target. An I2C master on the same physical bus can deliberately trigger this, causing the I2C target function to malfunction for all subsequent write transactions and desynchronizing consumer framing state (e.g. MCTP-over-I2C), a recoverable-by-reset denial of service of the target peripheral. The fix unmasks START_DET so the state is reset at every bus (re)START. Impact is availability-only over a local board-level bus; no memory corruption results in the in-tree consumer, whose per-byte buffer write is independently bounds-checked.

CVSS v3.1

Score 2.4low

Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected software

zephyrproject

zephyr

Affected versions
>=4.0.0 <4.4.2
GitHub Actionsmore threats →cve
zephyr
pkg:github/zephyr
Affected versions
>=4.0.0 <4.4.2

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 07/30/2026, 01:02:39 UTC

Technical Analysis

The vulnerability exists in the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) when operating in target/slave mode. The rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, but dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt handler, which would reset the state on every (re)START, was never enabled, leaving that recovery path inactive. Consequently, if the STOP interrupt is lost or a WRITE-repeated-START-WRITE sequence with the same direction occurs, the driver remains stuck in CMD_SEND state, preventing further write_requested() callbacks. This causes the I2C target function to malfunction for subsequent write transactions and desynchronizes consumer framing state, resulting in a denial of service that requires a reset to recover. The fix involves enabling the START_DET interrupt to reset the state at every bus (re)START. The impact is limited to availability on a local board-level bus with no memory corruption.

Potential Impact

An I2C master on the same physical bus can deliberately trigger this vulnerability to cause the I2C target peripheral to malfunction for all subsequent write transactions. This results in a denial of service condition that affects availability only and is recoverable by resetting the target device. There is no impact on confidentiality or integrity, and no memory corruption occurs.

Mitigation Recommendations

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix unmasks the START_DET interrupt so the driver state resets on every bus (re)START. Until a patch is available, affected systems should consider hardware or firmware resets to recover from this condition if it occurs.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
zephyr
Date Reserved
2026-06-02T15:26:20.475Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 6a67a90c9c2644c7f8a59f16

Added to database: 07/27/2026, 18:53:00 UTC

Last enriched: 07/30/2026, 01:02:39 UTC

Last updated: 09/10/2026, 20:02:43 UTC

Views: 103

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses