Loading story…
A high-severity vulnerability, CVE-2026-10673, was disclosed in the Zephyr RTOS ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver, affecting versions 3.7.0 through 4.4.0. The flaw is an out-of-bounds write in OA SPI RX frame reassembly: attacker-controlled 64-byte chunks can be copied into a fixed static buffer without verifying that the write cursor stays within bounds. An attacker on the adjacent single-pair Ethernet segment can send an oversized frame to corrupt memory in the driver's RX offload thread, causing denial of service and potentially enabling code execution.
Zephyr addressed the issue with May 1 patches that add bounds checking and state reset logic when a received packet exceeds CONFIG_ETH_ADIN2111_BUFFER_SIZE, dropping oversized frames and resetting ctx->scur. A related fix also corrected the Open Alliance buffer size calculation from 255 × 64 bytes to 255 × 68 bytes to account for each chunk's 4-byte header in addition to 64 bytes of data. The vulnerability was traced to OA SPI support introduced in commit 0ca8b0756b1, and published scoring indicates CVSS 8.6 with proof-of-concept exploitation status reported in CISA SSVC metadata.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-10673 was published describing an out-of-bounds write in Zephyr RTOS ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly affecting versions 3.7.0 through 4.4.0. The disclosure states that an adjacent attacker can send an oversized frame to cause memory corruption, leading to denial of service and potentially code execution.
Zephyr committed a fix in the ADIN2111 Ethernet driver to prevent writes past the configured buffer during OA SPI frame reassembly. The patch resets state, logs an error, and skips processing when a received frame would exceed the maximum buffer size.
A Zephyr RTOS commit corrected the ADIN2111 Open Alliance buffer size calculation from 255 × 64 bytes to 255 × 68 bytes to account for the 4-byte header in each chunk. The commit was authored and committed on May 1, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **`CVE-2026-10849`** was disclosed in the Zephyr RTOS **hawkBit OTA client**, where an off-by-one error in `response_json_cb()` can write a terminating NUL byte past the end of a heap buffer while processing an HTTP response body. The flaw affects Zephyr versions **`2.4.0` through `4.4.x`** and is remotely reachable because a hawkBit server can control response length and fragmentation, including in scenarios involving a malicious, compromised, or man-in-the-middle update server. The issue carries a **CVSS 3.1 score of 8.2** and is expected to primarily cause heap corruption and denial of service, with some potential for broader corruption depending on the allocator. The Zephyr Project addressed the bug in commit **`59d7ab58d853489e6134081cadb11733730264ac`**, which corrects the buffer sizing logic to allocate **body length plus one byte** for the trailing terminator. The patch also replaces `strncpy` with `memcpy` when copying the response fragment so the terminator remains within bounds, eliminating the out-of-bounds write condition in the hawkBit management subsystem.
Aug 4, 2026
**CVE-2023-45871** is an Important-rated buffer overflow in the Linux kernel’s Intel IGB Ethernet driver. When `rx-all`/store-bad-packet behavior is enabled, an oversized physical-layer frame can overflow a receive-ring buffer in `igb_configure_rx_ring`, potentially compromising system confidentiality, integrity, and availability. Red Hat assigned the flaw a CVSS v3.1 score of 7.5; exploitation requires an adjacent-network attacker and is considered high complexity because it depends on oversized frames and a non-default configuration. The upstream kernel fix updates `igb_set_rx_buffer_len` to allocate large receive buffers on systems with page sizes below 8192 bytes when either frames exceed `IGB_MAX_FRAME_BUILD_SKB` or the `E1000_RCTL_SBP` receive-control flag is set. Red Hat released corrected kernel, `kernel-rt`, and `kpatch` packages for affected Red Hat Enterprise Linux 7 and 8 streams in February and March 2024, with no qualifying mitigation listed at the time of its advisory.
Aug 26, 2026
**CVE-2025-39973** affects the Linux kernel’s Intel i40e Ethernet driver: a malicious virtual function can provide an oversized or misaligned `ring_len` value that is passed to a hardware memory context without adequate validation. The condition can create excessive transmit or receive queue lengths, potentially resulting in memory corruption or undefined behavior. Red Hat rates the issue Moderate with a CVSS v3.1 score of 7.5, while CVE.org assigns 8.8 under different environmental assumptions; RHEL 7 through 10, including applicable real-time kernels, are listed as affected, while RHEL 6 is not affected. The defect aligns with **CWE-131**, incorrect calculation of buffer size, a memory-safety weakness that can lead to out-of-bounds access, crashes, sensitive-data exposure, or code execution. Red Hat’s RHSA-2025:21469 provides updated RHEL 9 kernel packages for multiple kernel security issues and requires a reboot after installation; however, Red Hat’s CVE record separately reports no qualifying mitigation for CVE-2025-39973. Organizations should identify systems using affected i40e hardware and virtual-function configurations, apply applicable vendor kernel updates, reboot hosts, and restrict untrusted VF access where operationally possible.
Aug 25, 2026