CVE-2026-10679

Name of the Vulnerable Software and Affected Versions Zephyr versions prior to 4.4.1

Description The DesignWare SPI driver in drivers/spi/spi dw.c fails to validate the config->frequency variable when computing the SPI BAUDR clock divider. Because the spi transceive system call and its verify handler in drivers/spi/spi handlers.c copy the spi config from userspace without checking the frequency field, an unprivileged userspace thread with access to a DesignWare SPI device kernel object can set frequency to 0. This triggers an unsigned integer divide-by-zero in the spi dw configure() function. On Cortex-M Mainline and ARC architectures, this results in a CPU exception, leading to a kernel fault and local denial of service. This issue requires CONFIG USERSPACE=y to be enabled.

Recommendations Update to a version later than 4.4.0. As a temporary mitigation, restrict unprivileged userspace thread access to the DesignWare SPI driver.