CVE-2026-10683 in Zephyr
Summary
by MITRE • 07/27/2026
In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START, was never added to the enabled interrupt mask in i2c_dw_slave_register(), so that recovery path was dead code.
As a result, if the STOP interrupt is lost (bus glitch/reset, or a concurrent master driving STOP) or the bus master issues a legal WRITE-repeated-START-WRITE sequence with the same direction, the driver remains in CMD_SEND permanently and never invokes write_requested() again for the life of the target.
An I2C master on the same physical bus can deliberately trigger this, causing the I2C target function to malfunction for all subsequent write transactions and desynchronizing consumer framing state (e.g. MCTP-over-I2C), a recoverable-by-reset denial of service of the target peripheral.
The fix unmasks START_DET so the state is reset at every bus (re)START. Impact is availability-only over a local board-level bus; no memory corruption results in the in-tree consumer, whose per-byte buffer write is independently bounds-checked.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability exists within the Synopsys DesignWare I2C driver implementation where the slave/target mode operation suffers from a state management flaw that leads to permanent desynchronization of the I2C target function. This issue manifests when the driver's interrupt handling logic fails to properly reset the communication state following bus restart conditions, creating a condition where subsequent write operations become unresponsive. The root cause stems from an incomplete interrupt mask configuration that excludes the START_DET interrupt from being enabled during slave registration, despite having the necessary handler code implemented in i2c_dw_slave_read_clear_intr_bits(). This architectural oversight creates a critical gap in the driver's ability to recover from legitimate bus conditions such as repeated start sequences or bus glitches.
The technical flaw operates through a cascading state management failure where dw->state remains perpetually set to CMD_SEND due to the absence of START_DET interrupt processing, while the write_requested() callback mechanism becomes permanently disabled. The driver's state machine design relies on proper interrupt handling to transition between READY and CMD_SEND states, but when STOP interrupts are lost due to physical bus issues or concurrent master activity, the system cannot recover because the recovery path through START_DET is inactive. This creates a persistent denial of service condition that affects all subsequent write transactions without requiring any special privileges or complex attack vectors.
The operational impact extends beyond simple functionality degradation to potentially compromise the integrity of higher-level protocols that depend on synchronized I2C communication patterns. When an attacker can deliberately trigger this condition, they effectively create a recoverable-by-reset denial of service scenario that disrupts the target peripheral's ability to process data correctly. The specific case mentioned involving MCTP-over-I2C demonstrates how this vulnerability can cascade into broader system reliability issues, as consumer framing state becomes desynchronized and all subsequent write operations fail until hardware reset occurs. This represents a clear violation of availability principles in information security, though the absence of memory corruption means the vulnerability does not provide direct access to system resources or data confidentiality.
The fix implemented addresses the core architectural issue by enabling the START_DET interrupt in the slave registration function, thereby restoring the intended recovery mechanism that should reset the state machine at every bus restart condition. This change aligns with established security practices for interrupt handling and state management in embedded systems, following principles similar to those outlined in CWE-691 where insufficient interrupt handling can lead to persistent system malfunctions. The solution maintains the existing bounds checking mechanisms while restoring proper state transition behavior, ensuring that the driver can recover from legitimate bus restart conditions without requiring full system reset. This remediation follows ATT&CK framework concepts related to system recovery and availability attacks, where maintaining proper interrupt handling is crucial for preventing denial of service conditions in embedded systems.
The vulnerability demonstrates how incomplete interrupt configuration can lead to serious availability issues in embedded systems, particularly affecting I2C slave operations that must maintain synchronization across multiple transactions. The fix ensures that the driver properly handles all legal bus conditions including repeated start sequences and bus restarts, which are common occurrences in real-world I2C deployments where multiple masters may interact with the same bus segments. This type of vulnerability is particularly dangerous in automotive or industrial applications where I2C communication reliability directly impacts system safety and functionality, making proper interrupt handling a critical security consideration for embedded device drivers.