CVE-2026-10679: Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)
The DesignWare SPI driver (drivers/spi/spidw.c) computed the SPI BAUDR clock divider as info->clockfrequency / config->frequency without validating config->frequency.
spitransceive is a Zephyr syscall and its verify handler (drivers/spi/spihandlers.c) copies the caller-supplied spiconfig from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spidwconfigure().
On Cortex-M Mainline (SCB->CCR.DIV0TRP is set in zarmfaultinit()) and on ARC (a dedicated evdivzero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service.
The fix rejects zero frequency and frequencies above clockfrequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIGUSERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zephyr (drivers/spi/spi_dw.c / drivers/spi/spi_handlers.c)to a version that resolves this vulnerability.Fixed in v4.4.0 - Configuration
Update spi_dw_configure() to validate config->frequency: return -EINVAL if config->frequency is zero, and return -EINVAL if config->frequency is greater than clock_frequency / 2 (DesignWare SSI databook minimum SCKDIV of 2). This prevents the divide-by-zero from info->clock_frequency / config->frequency.
DesignWare SPI driver (drivers/spi/spi_dw.c) config->frequency validation in spi_dw_configure() = Reject frequency = 0 and reject frequency > (info->clock_frequency / 2) with -EINVAL - Configuration
Modify the verify handler for the spi_transceive __syscall to check the caller-supplied spi_config.frequency after copying from userspace and before passing it to spi_dw_configure(). Ensure frequency=0 and frequency>clock_frequency/2 are rejected (e.g., with -EINVAL) so an unprivileged userspace caller cannot trigger the divide-by-zero.
Zephyr syscall handler for spi_transceive (drivers/spi/spi_handlers.c) spi_config frequency field handling in userspace->kernel copy = Validate frequency field before invoking the DesignWare SPI driver; reject invalid values - Compensating control
If immediate patching is not possible, avoid granting unprivileged userspace threads CONFIG_USERSPACE=y SPI driver permission for DesignWare SPI device kernel objects, since exploitation requires userspace access and an unprivileged thread already granted SPI permissions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10679?
The severity of CVE-2026-10679 is medium with a score of 5.5.
What type of vulnerability is CVE-2026-10679?
CVE-2026-10679 is a divide-by-zero vulnerability in the DesignWare SPI driver.
How can CVE-2026-10679 lead to a DoS?
CVE-2026-10679 can lead to a local denial of service due to an unvalidated frequency input that causes a divide-by-zero error.
Which software is affected by CVE-2026-10679?
CVE-2026-10679 affects the Zephyr operating system as it involves the DesignWare SPI driver.
How do I fix CVE-2026-10679?
To fix CVE-2026-10679, ensure proper validation of the config->frequency input before it is used in calculations.