The DesignWare SPI driver in Zephyr computes the SPI BAUDR clock divider by dividing info->clock_frequency by config->frequency without validating config->frequency. The spi_transceive syscall copies the spi_config from userspace without checking the frequency field, allowing a userspace thread with SPI device access to supply a frequency of zero. This triggers an unsigned integer divide-by-zero in spi_dw_configure(), causing a CPU exception on Cortex-M and ARC architectures, resulting in a kernel fault and local denial of service. The vulnerability affects all Zephyr releases up to and including v4.4.0 with CONFIG_USERSPACE=y and requires an unprivileged thread already granted SPI driver permission. The fix rejects zero and excessively high frequencies with an error code. No memory corruption or information disclosure occurs.

Exploitation causes a local denial of service by triggering a kernel fault due to a divide-by-zero CPU exception. There is no impact on confidentiality or integrity, and no memory corruption or information disclosure is involved. The vulnerability requires local access with specific permissions and userspace enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves rejecting zero and invalid frequency values in the SPI driver configuration. Until patched, ensure that unprivileged userspace threads are not granted permission to access the DesignWare SPI driver or disable CONFIG_USERSPACE if not needed.