ZephyrProject Zephyr up to 4.4.0 DesignWare SPI driver drivers/spi/spi_dw.c spi_dw_configure frequency divide by zero

Summaryinfo

A vulnerability labeled as critical has been found in ZephyrProject Zephyr up to 4.4.0. This impacts the function spi_dw_configure of the file drivers/spi/spi_dw.c of the component DesignWare SPI driver. Such manipulation of the argument frequency leads to divide by zero. This vulnerability is traded as CVE-2026-10679. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in ZephyrProject Zephyr up to 4.4.0. It has been rated as critical. Affected by this issue is the function spi_dw_configure of the file drivers/spi/spi_dw.c of the component DesignWare SPI driver. The manipulation of the argument frequency with an unknown input leads to a divide by zero vulnerability. Using CWE to declare the problem leads to CWE-369. The product divides a value by zero. Impacted is availability. CVE summarizes:

The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency. spi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(). On Cortex-M Mainline (SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service. The fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-10679 since 06/02/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 4.5.0 eliminates this vulnerability. Applying the patch 65935885622b0e4a5dbe5b82504c30097eb75ce0 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Project Management Software

Vendor

• ZephyrProject

Name

• Zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion