Description
In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START, was never added to the enabled interrupt mask in i2c_dw_slave_register(), so that recovery path was dead code.

As a result, if the STOP interrupt is lost (bus glitch/reset, or a concurrent master driving STOP) or the bus master issues a legal WRITE-repeated-START-WRITE sequence with the same direction, the driver remains in CMD_SEND permanently and never invokes write_requested() again for the life of the target.

An I2C master on the same physical bus can deliberately trigger this, causing the I2C target function to malfunction for all subsequent write transactions and desynchronizing consumer framing state (e.g. MCTP-over-I2C), a recoverable-by-reset denial of service of the target peripheral.

The fix unmasks START_DET so the state is reset at every bus (re)START. Impact is availability-only over a local board-level bus; no memory corruption results in the in-tree consumer, whose per-byte buffer write is independently bounds-checked.
Published: 2026-07-27
Score: 2.4 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the Synopsys DesignWare I2C driver used within Zephyr when operating in target/slave mode. An incomplete interrupt reset logic allows the driver to remain in a permanently stuck CMD_SEND state if a STOP interrupt is lost or a repeated-START WRITE sequence is issued, causing the driver to stop invoking the write_requested callback for all future writes. This results in an availability-only denial of service affecting the I2C target device, without causing memory corruption or affecting core system integrity. The weakness corresponds to CWE-835 due to the infinite loop or dead state.

Affected Systems

Zephyr Project's Zephyr RTOS, specifically the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c). Versions before the patch that enabled the START_DET interrupt mask are susceptible; the exact affected releases are not listed in the advisory.

Risk and Exploitability

The CVSS score for this issue is 2.4, reflecting its low severity. Because EPSS is < 1% and it is not listed in CISA's KEV catalog, the evidence for widespread exploitation is limited. Nevertheless the flaw is exploitable by an attacker or system component that has direct access to the I2C bus and can issue a malicious write-repeated-START sequence, leading to a permanent denial of service on that board-level bus.

Generated by OpenCVE AI on August 3, 2026 at 16:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Zephyr to a release that incorporates the commit enabling the START_DET interrupt (commit 06e2053efe0e324d71cc29cdd95160fff643730a).
  • Verify that I2C target devices are correctly reinitialized after the update and that repeated write sequences succeed without stalling.
  • If an update cannot be applied immediately, temporarily disable I2C target mode or remove I2C target devices from the bus to mitigate the risk.

Generated by OpenCVE AI on August 3, 2026 at 16:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*

Tue, 28 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, whose handler in i2c_dw_slave_read_clear_intr_bits() would reset the state on every (re)START, was never added to the enabled interrupt mask in i2c_dw_slave_register(), so that recovery path was dead code. As a result, if the STOP interrupt is lost (bus glitch/reset, or a concurrent master driving STOP) or the bus master issues a legal WRITE-repeated-START-WRITE sequence with the same direction, the driver remains in CMD_SEND permanently and never invokes write_requested() again for the life of the target. An I2C master on the same physical bus can deliberately trigger this, causing the I2C target function to malfunction for all subsequent write transactions and desynchronizing consumer framing state (e.g. MCTP-over-I2C), a recoverable-by-reset denial of service of the target peripheral. The fix unmasks START_DET so the state is reset at every bus (re)START. Impact is availability-only over a local board-level bus; no memory corruption results in the in-tree consumer, whose per-byte buffer write is independently bounds-checked.
Title DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)
Weaknesses CWE-835
References
Metrics cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-27T19:00:53.973Z

Reserved: 2026-06-02T15:26:20.475Z

Link: CVE-2026-10683

cve-icon Vulnrichment

Updated: 2026-07-27T19:00:49.180Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-27T19:17:14.683

Modified: 2026-08-12T14:21:50.690

Link: CVE-2026-10683

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T17:00:06Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')