CVE-2026-10679: Zephyr DesignWare SPI Driver DoS Flaw

CVE-2026-10679 Overview

CVE-2026-10679 is a divide-by-zero flaw [CWE-369] in the Zephyr RTOS DesignWare Serial Peripheral Interface (SPI) driver at drivers/spi/spi_dw.c. The driver computes the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating the config->frequency field. The spi_transceive syscall verify handler in drivers/spi/spi_handlers.c copies the caller-supplied spi_config from userspace without frequency validation. An unprivileged userspace thread already granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure(). The defect affects all Zephyr releases up to and including v4.4.0.

Critical Impact
Local unprivileged threads with SPI device permission can raise a CPU exception on Cortex-M Mainline and ARC targets, causing a kernel fault and local denial of service.

Affected Products

Zephyr RTOS releases up to and including v4.4.0
DesignWare SPI driver (drivers/spi/spi_dw.c) on Cortex-M Mainline builds where SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()
DesignWare SPI driver on ARC targets with the __ev_div_zero exception vector

Discovery Timeline

2026-07-21 - CVE-2026-10679 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-10679

Vulnerability Analysis

The flaw resides in the DesignWare SPI configuration path. When a thread invokes spi_transceive, the syscall verify handler copies the spi_config structure from userspace and forwards it to spi_dw_configure(). That function computes the baud rate divider by dividing info->clock_frequency by config->frequency without checking that config->frequency is non-zero or within the range required by the DesignWare Synchronous Serial Interface (SSI) databook.

On Cortex-M Mainline targets the divide-by-zero trap is enabled during architecture init through SCB->CCR.DIV_0_TRP. On ARC the __ev_div_zero vector raises a dedicated exception. Either path terminates the offending thread with a kernel fault. There is no memory-corruption or information-disclosure impact.

Exploitation requires CONFIG_USERSPACE=y and a userspace thread that has already been granted permission to the SPI driver kernel object, limiting the attack surface to configurations that expose SPI to unprivileged code.

Root Cause

Missing input validation on a syscall boundary. The verify handler in drivers/spi/spi_handlers.c does not check the frequency field before the driver performs unsigned integer division against it.

Attack Vector

A local, low-privileged thread with prior access to the DesignWare SPI device object calls spi_transceive with a spi_config structure whose frequency field is zero. spi_dw_configure() performs info->clock_frequency / 0, triggering a CPU divide-by-zero exception and a kernel fault.

// Patch: drivers/spi/spi_dw.c - reject invalid frequencies
		return -ENOTSUP;
	}

+	/* zero frequency would cause DIV/0 in clk divider calc */
+	if (!config->frequency) {
+		LOG_ERR("(%s): Frequency must not be zero", dev->name);
+		return -EINVAL;
+	}
+
+	/* return error if the expected bus frequency is
+	 * greater than half of the input core clock frequency
+	 */
+	if (config->frequency > (info->clock_frequency / DW_SPI_MIN_SCKDIV)) {
+		LOG_ERR("(%s): Invalid bus frequency", dev->name);
+		return -EINVAL;
+	}
+
	/* Word size */
	if (!IS_ENABLED(CONFIG_SPI_DW_HSSI) && (info->max_xfer_size == 32)) {
		ctrlr0 |= DW_SPI_CTRLR0_DFS_32(SPI_WORD_SIZE_GET(config->operation));

Source: Zephyr commit 65935885622b

Detection Methods for CVE-2026-10679

Indicators of Compromise

Kernel fault log entries referencing a divide-by-zero exception on Cortex-M or ARC targets running Zephyr
Repeated crashes or reboots of a Zephyr device shortly after userspace threads invoke spi_transceive
Log messages containing Frequency must not be zero or Invalid bus frequency after applying the patch, indicating attempted abuse

Detection Strategies

Enable Zephyr fault logging and forward kernel exception traces to a central log aggregator for review of divide-by-zero faults on SPI code paths
Audit build configurations for CONFIG_USERSPACE=y combined with granted access to DesignWare SPI kernel objects, since only that combination is exploitable
Instrument spi_dw_configure() or the spi_transceive verify handler to record calling thread identifiers and spi_config field values during testing

Monitoring Recommendations

Monitor device telemetry for unexpected resets or watchdog-initiated reboots on fielded Zephyr systems using the DesignWare SPI driver
Track firmware crash reports for __ev_div_zero on ARC and CFSR divide-by-zero bits on Cortex-M Mainline
Review kernel object permission grants to unprivileged threads and alert on grants to SPI devices in production images

How to Mitigate CVE-2026-10679

Immediate Actions Required

Apply the upstream fix from Zephyr commit 65935885622b0e4a5dbe5b82504c30097eb75ce0 to drivers/spi/spi_dw.c and drivers/spi/spi_dw_regs.h
Upgrade Zephyr to a release that contains the frequency validation fix if running v4.4.0 or earlier
Review kernel object permissions and revoke DesignWare SPI access from any unprivileged threads that do not require it

Patch Information

The fix rejects zero frequency and any frequency above clock_frequency / 2 with -EINVAL. The bound reflects the DesignWare SSI databook minimum SCKDIV of 2, defined as DW_SPI_MIN_SCKDIV in drivers/spi/spi_dw_regs.h. See the Zephyr Security Advisory GHSA-3qcm-qwh2-v4hq and the upstream commit for full patch details.

Workarounds

Disable CONFIG_USERSPACE in builds that do not require userspace isolation, eliminating the syscall attack surface
Do not grant DesignWare SPI kernel object permissions to unprivileged threads until the patch is applied
Wrap spi_transceive in a privileged shim that validates config->frequency before dispatching to the driver

bash

# Fetch and apply the upstream fix
git fetch origin
git cherry-pick 65935885622b0e4a5dbe5b82504c30097eb75ce0
west build -p auto -b <board> samples/drivers/spi