What is CVE-2026-10679?
The DesignWare SPI driver (drivers/spi/spi_dw.c) calculates the SPI BAUDR clock divider without validating config->frequency, potentially leading to a division-by-zero vulnerability. This primarily affects systems using Zephyr RTOS, where the spi_transceive syscall verify handler may be bypassed. Immediate driver code update is recommended.
Azərbaycanca: DesignWare SPI sürücüsündə (drivers/spi/spi_dw.c) SPI BAUDR clock divider hesablanması zamanı config->frequency dəyəri yoxlanılmır ki, bu da sıfıra bölmə zəifliyinə səbəb ola bilər. Əsasən Zephyr RTOS istifadə edən sistemlərə təsir edir; spi_transceive çağırışı zamanı təhlükəsizlik yoxlamasından yayınmaq mümkündür. Dərhal sürücü kodunu yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-20
FAQ1
In which component was CVE-2026-10679 discovered and what is its root cause?
This vulnerability was discovered in the DesignWare SPI driver (drivers/spi/spi_dw.c). The lack of validation for the config->frequency value during the SPI BAUDR clock divider calculation can lead to a division-by-zero vulnerability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.