{"id":"CVE-2026-10679","summary":"Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)","details":"The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info-\u003eclock_frequency / config-\u003efrequency without validating config-\u003efrequency.\n\nspi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure().\n\nOn Cortex-M Mainline (SCB-\u003eCCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service.\n\nThe fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.","aliases":["GHSA-3qcm-qwh2-v4hq"],"modified":"2026-11-05T08:04:07.917522080Z","published":"2026-07-21T21:30:55.714Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10679.json","cna_assigner":"zephyr","cwe_ids":["CWE-369"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10679.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3qcm-qwh2-v4hq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10679"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/65935885622b0e4a5dbe5b82504c30097eb75ce0"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"fcb9144dca68f98d24caf39532595555355c3c1d"},{"fixed":"75f67d766726351b30199f9a2bf55803d717a3be"},{"introduced":"684c9e8f32e4373a21098559f748f06915f950c9"},{"fixed":"dccb09599635bdff17633fa7e9dab014b91dce90"},{"fixed":"65935885622b0e4a5dbe5b82504c30097eb75ce0"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"1.8.0"},{"fixed":"4.3.1"}]},{"range":[{"introduced":"4.4.0"},{"fixed":"4.4.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"65935885622b0e4a5dbe5b82504c30097eb75ce0"}]}]}}],"versions":["v4.4.2-rc1","v4.4.1","v4.4.1-rc1","v4.4.0"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/zephyrproject-rtos/zephyr/commit/65935885622b0e4a5dbe5b82504c30097eb75ce0","target":{"file":"drivers/spi/spi_dw.c"},"deprecated":false,"digest":{"line_hashes":["82776265846683227006542027459325250091","146856296094369967311468552804903037937","177797596829250425287737839546708089675"],"threshold":0.9},"id":"CVE-2026-10679-6f8ece94","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/65935885622b0e4a5dbe5b82504c30097eb75ce0","target":{"function":"spi_dw_configure","file":"drivers/spi/spi_dw.c"},"deprecated":false,"digest":{"length":2591,"function_hash":"49403922862781008198449116658616648094"},"id":"CVE-2026-10679-7ee18cf1"}],"vanir_signatures_modified":"2026-11-05T08:04:07Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10679.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}]}