Zephyr RTOS CVE-2026-10673

The target device must run Zephyr RTOS versions 3.7.0 through 4.4.x with an ADIN2111 or ADIN1110 Ethernet interface compiled into the firmware and operating in OPEN Alliance (OA) SPI mode - the code path introduced in commit 0ca8b0756b1 must be active. Drivers not using OA SPI mode do not execute the vulnerable reassembly function. The attacker must have a device on the same physical single-pair Ethernet segment (10BASE-T1S or 10BASE-T1L), as AV:A means Internet-routable exploitation is not possible. No authentication is required (PR:N) and no user interaction is needed (UI:N). The primary limiting factors are physical adjacency to the target bus and the requirement for ADIN2111/1110 hardware - deployments using other Ethernet PHYs or standard SPI mode are not affected.

The CVSS 8.8 vector (AV:A/AC:L/PR:N/UI:N) accurately reflects that exploitation requires only adjacency to the target's single-pair Ethernet segment with no authentication or user interaction, making it trivial for any attacker on that wire. However, several signals moderate the actual urgency. EPSS at 0.23% (14th percentile) indicates very low observed exploitation activity relative to all CVEs, consistent with the niche hardware footprint - ADIN2111/1110 chips appear primarily in industrial IoT, automotive, and embedded sensing applications where internet-facing exposure is rare. SSVC classifies automatable as 'no' and technical impact as 'partial', meaningfully undercutting the full C:H/I:H/A:H CVSS impact rating; reliable code execution from a kernel heap/stack overwrite on an RTOS requires non-trivial memory layout knowledge, though DoS is straightforward. The discrepancy between CVSS 'Total' impact and SSVC 'Partial' technical impact should be noted: SSVC likely reflects that confirmed code execution has not been demonstrated, while CVSS rates worst-case theoretical potential. Real-world priority is elevated for any deployment using ADIN2111/1110 hardware in OA SPI mode on network segments shared with untrusted devices (e.g., industrial field buses, building automation), and low for air-gapped or physically secured single-pair segments.

An attacker with a device connected to the same 10BASE-T1S or 10BASE-T1L single-pair Ethernet bus as a Zephyr-based target sends a sequence of crafted OA SPI frame chunks whose aggregate reassembled size exceeds 1524 bytes, exploiting the absent bounds check in eth_adin2111_oa_data_read(). The RX offload thread blindly copies attacker-controlled frame bytes past the end of ctx->buf into adjacent kernel memory structures, which on a resource-constrained RTOS can immediately corrupt thread stacks or function pointers. A proof-of-concept is indicated by SSVC classification, and while reliable code execution requires knowledge of the target's memory layout, a denial-of-service crash is straightforward to achieve.