CVE-2026-10679

Analyzed Analyzed - Analysis Complete

SPI Divide-by-Zero in Zephyr Kernel

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: Zephyr Project

Description

The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency. spi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(). On Cortex-M Mainline (SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service. The fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-10679

Affected Vendors & Products

Vendor	Product	Version / Range
zephyrproject	zephyr	From 1.8.0 (inc) to 4.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-369	The product divides a value by zero.

Attack-Flow Graph

Executive Summary

This vulnerability involves a divide-by-zero error in the DesignWare SPI driver of the Zephyr RTOS. A userspace thread with access to a SPI device can set the frequency to zero, causing an integer division by zero in the driver's configuration function. This triggers a CPU exception, leading to a kernel fault and denial of service.

Detection Guidance

This vulnerability can be detected by checking for kernel faults or crashes on Cortex-M or ARC systems running Zephyr with CONFIG_USERSPACE=y and DesignWare SPI driver enabled. Monitor for divide-by-zero exceptions or SPI-related kernel panics.

Impact Analysis

The vulnerability can cause a local denial of service by crashing the kernel. It requires an unprivileged thread to already have SPI driver permissions and CONFIG_USERSPACE enabled. There is no risk of memory corruption or data leakage.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it does not involve unauthorized data access, disclosure, or processing. The issue causes a local denial of service via kernel fault but does not impact data integrity or confidentiality.

Mitigation Strategies

Update Zephyr to a version after v4.4.0 where the fix is applied.
Disable CONFIG_USERSPACE if not required to prevent unprivileged SPI access.
Ensure SPI frequency configurations are validated and non-zero.

Hi! I’m here to help you understand CVE-2026-10679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70