The Zephyr driver for ADIN2111/ADIN1110 Ethernet controllers reassembles received frames in OA SPI mode by copying data chunks into a fixed static buffer. The implementation does not verify that the write cursor plus the chunk length stays within the buffer limits. This oversight results in an out-of-bounds write that can corrupt neighboring kernel memory, potentially causing a denial of service or enabling code execution. The vulnerability is catalogued as CWE-125 and CWE-787. Systems that employ the ADIN2111 or ADIN1110 PHYs on single‑pair 10BASE‑T1S/T1L Ethernet segments and run these Zephyr releases are vulnerable. Attacker-supplied frames exceeding this limit can overflow the buffer.

Affected systems are Zephyr RTOS releases 3.7.0 through 4.4.0 that include the ADIN2111/ADIN1110 Ethernet driver. Devices that use the ADIN2111 or ADIN1110 PHYs on single‑pair 10BASE‑T1S/T1L Ethernet segments and compile with CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes) are vulnerable. The buffer overflow occurs during the reassembly of received frames in OA SPI mode.

With a CVSS score of 8.3 the vulnerability has a high severity, while the EPSS score of < 1% indicates a low but non‑zero probability of exploitation. It is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote network attack by an adversary on the local single‑pair Ethernet segment; authenticated access is not required, inferred from the remote reachability of the flaw. The driver’s RX offload thread can be forced to write attacker‑controlled data beyond the static buffer, potentially corrupting adjacent kernel memory and leading to denial of service or code execution.