Description
The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency.

spi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure().

On Cortex-M Mainline (SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service.

The fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.
Published: 2026-07-21
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The DesignWare SPI driver calculates a baud rate divider by dividing the controller’s clock frequency by the requested transfer frequency without verifying that the frequency is non‑zero. When an unprivileged userspace thread, granted permission to a DesignWare SPI device, passes a zero frequency value to the spi_transceive syscall, the driver performs an unsigned integer divide‑by‑zero during initialization, causing a CPU fault and a kernel crash. The vulnerability only leads to a local denial of service; there is no memory corruption or data disclosure impact.

Affected Systems

All Zephyr releases up to and including version 4.4.0 are affected. The issue is present when CONFIG_USERSPACE is enabled and an unprivileged thread has been granted SPI driver permissions. The vendor affected is Zephyr Project.

Risk and Exploitability

The CVSS score of 3.3 indicates low severity, and the EPSS score is below 1 %, reflecting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unprivileged userspace thread that already has Access to a DesignWare SPI device kernel object and the ability to supply a configuration with a zero frequency. On Cortex‑M hardware with the DIV_0_TRP trap enabled and ARC processors with the dedicated divide‑by‑zero vector, the fault disrupts system operation via a kernel panic.

Generated by OpenCVE AI on July 30, 2026 at 16:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a release newer than v4.4.0, where the driver has been fixed to reject zero and overly large frequencies with an -EINVAL error.
  • In environments that cannot upgrade immediately, modify application code to validate the spi_config.frequency field before invoking spi_transceive, ensuring it is neither zero nor larger than half the controller clock.
  • Reevaluate the use of CONFIG_USERSPACE and restrict or deny SPI driver permissions to untrusted userspace threads, limiting the attack surface for this local denial‑of‑service condition.

Generated by OpenCVE AI on July 30, 2026 at 16:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency. spi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(). On Cortex-M Mainline (SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service. The fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.
Title Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)
Weaknesses CWE-369
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-22T19:36:39.798Z

Reserved: 2026-06-02T15:26:09.584Z

Link: CVE-2026-10679

cve-icon Vulnrichment

Updated: 2026-07-22T19:32:24.478Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:17:00.177

Modified: 2026-07-30T15:54:36.877

Link: CVE-2026-10679

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T16:15:04Z

Weaknesses