PT-2026-62126 · Zephyrproject · Zephyr
CVE-2026-10679
·
Published
2026-07-21
·
Updated
2026-07-21
CVSS v3.1
3.3
Low
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
The DesignWare SPI driver (drivers/spi/spi dw.c) computed the SPI BAUDR clock divider as info->clock frequency / config->frequency without validating config->frequency.
spi transceive is a Zephyr syscall and its verify handler (drivers/spi/spi handlers.c) copies the caller-supplied spi config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi dw configure().
On Cortex-M Mainline (SCB->CCR.DIV 0 TRP is set in z arm fault init()) and on ARC (a dedicated ev div zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service.
The fix rejects zero frequency and frequencies above clock frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.
Fix
Divide By Zero
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zephyr