{"id":"CVE-2026-10679","aliases":[],"cve":{"records":[{"id":"CVE-2026-10679","source":"zephyr","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-02T15:26:09.584Z","published":"2026-07-21T21:30:55.714Z","modified":"2026-11-04T04:58:58.044Z"}],"publishers":[{"name":"zephyr","role":"CNA","organizationId":"e2e69745-5e70-4e92-8431-deb5529a81ad","modified":"2026-11-04T04:58:58.044Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-07-22T19:36:39.798Z"}],"references":[{"url":"https://github.com/zephyrproject-rtos/zephyr/commit/65935885622b0e4a5dbe5b82504c30097eb75ce0","tags":["patch"],"source":"zephyr"},{"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3qcm-qwh2-v4hq","tags":[],"source":"zephyr"}],"weaknesses":[{"id":"CWE-369","description":"dos","source":"zephyr"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-07-22T19:32:22.710575Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)","titleSource":"zephyr","descriptionSource":"zephyr","description":"The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency.\n\nspi_transceive is a Zephyr __syscall and its verify handler (drivers/spi/spi_handlers.c) copies the caller-supplied spi_config from userspace without checking the frequency field, so a userspace thread that has been granted access to a DesignWare SPI device kernel object can pass frequency = 0 and trigger an unsigned integer divide-by-zero in spi_dw_configure().\n\nOn Cortex-M Mainline (SCB->CCR.DIV_0_TRP is set in z_arm_fault_init()) and on ARC (a dedicated __ev_div_zero vector) this raises a CPU exception, resulting in a kernel fault and local denial of service.\n\nThe fix rejects zero frequency and frequencies above clock_frequency / 2 (the DesignWare SSI databook minimum SCKDIV of 2) with -EINVAL. The defect affects all Zephyr releases up to and including v4.4.0; exploitation requires CONFIG_USERSPACE=y and an unprivileged thread already granted SPI driver permission. There is no memory-corruption or information-disclosure impact.","score":3.3,"severity":"low","published":"2026-07-21T21:30:55.714Z","modified":"2026-11-04T04:58:58.044Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"zephyrproject","name":"zephyr","platforms":[],"versions":[{"version":"1.8.0","status":"affected","lessThan":"4.3.1","versionType":"semver"},{"version":"4.4.0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"zephyr","url":"https://www.cve.org/CVERecord?id=CVE-2026-10679"}],"remediation":[],"references":["https://github.com/zephyrproject-rtos/zephyr/commit/65935885622b0e4a5dbe5b82504c30097eb75ce0","https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3qcm-qwh2-v4hq"],"sources":[{"name":"CVE","id":"CVE-2026-10679","modified":"2026-11-04T04:58:58.044Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-10679"}],"assessments":[{"source":"zephyr","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","score":3.3}],"sourceAffected":[],"observedAt":"2026-11-04T05:06:43.734Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:10:33.488Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-04T08:40:33.052Z","attemptedAt":"2026-11-04T08:40:33.052Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-04T08:40:32.026Z","attemptedAt":"2026-11-04T08:40:32.026Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-04T08:40:31.958Z","attemptedAt":"2026-11-04T08:40:31.958Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-04T08:40:32.036Z","attemptedAt":"2026-11-04T08:40:32.036Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-46448","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46448","modified":"Nov 4, 2026, 4:58:58 AM","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-11-04T08:40:31.958Z"},{"source":"FIRST EPSS","id":"CVE-2026-10679","url":"https://www.first.org/epss/","probability":0.00136,"percentile":0.03043,"date":"2026-11-03","checkedAt":"2026-11-04T08:40:32.036Z"},{"source":"NVD","id":"CVE-2026-10679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10679","modified":"2026-10-24T19:10:00.127","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-11-04T08:40:33.052Z"},{"source":"NVD","id":"CVE-2026-10679","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10679","modified":"2026-10-24T19:10:00.127","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-04T08:40:33.052Z"}],"aiSummary":{"text":"The Zephyr DesignWare SPI driver has a divide-by-zero weakness, allowing local denial of service. Affected versions are up to and including v4.4.0. Exploitation requires an unprivileged thread with SPI driver permission and CONFIG_USERSPACE=y.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T05:36:12.638Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-10679"}]}}