Zephyr RTOS CVE-2026-10679

Exploitation requires two non-default, deployment-specific conditions that must both be present simultaneously. First, the firmware must be compiled with CONFIG_USERSPACE=y, a build-time option that enables the Zephyr userspace isolation model; this is not enabled in the default Zephyr configuration and must be explicitly selected by the integrator. Second, the attacking userspace thread must have already been granted access to the specific DesignWare SPI device kernel object via an explicit k_object_access_grant() call in application code - meaning the application developer or firmware integrator must have intentionally authorized that thread for SPI access. Exploitation is limited to local code execution within an already-running, already-authorized thread; remote exploitation is not possible. There is no impact on confidentiality or integrity, and the fault does not enable privilege escalation or code injection. These conditions collectively limit real-world exposure to multi-tenant embedded applications where partially-trusted tasks coexist and SPI device access has been shared.

The CVSS 3.1 base score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) accurately captures the limited blast radius: local access, low complexity once prerequisites are met, partial availability impact only, and no confidentiality or integrity consequence. The description explicitly confirms there is no memory-corruption or information-disclosure path, consistent with C:N/I:N. No EPSS data was provided and no CISA KEV listing exists, meaning no confirmed or widespread exploitation is known. Practical risk is further constrained by two hard prerequisites - CONFIG_USERSPACE=y must be selected at build time (it is not the default Zephyr configuration) and the attacking thread must have been explicitly granted the SPI kernel object via k_object_access_grant() or equivalent, meaning an already-privileged configuration path must have been deliberately taken by a developer or integrator. This positions the vulnerability as low operational priority for most embedded deployments: an attacker exploiting this already has locally authorized access and can only cause a controlled kernel fault. The sole realistic concern is a malicious or compromised task within a multi-tenant embedded application deliberately crashing the device.

A malicious or compromised unprivileged thread in a Zephyr application built with CONFIG_USERSPACE=y and granted access to a DesignWare SPI device kernel object calls spi_transceive with a crafted spi_config where the frequency field is set to zero. The syscall verify handler copies the struct without validation, spi_dw_configure() computes BAUDR as clock_frequency/0, and the Cortex-M UsageFault or ARC divide-by-zero exception handler triggers a kernel fault, halting the device. No public exploit code is known to exist.