HIGH Introduced in 7.0
clk SpacemitHdma Panic
CVE-2026-80523
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
KernelScan AI5.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will hang, for example in the case of a vector instruction access generates a page fault.
02KernelScan AI Analysis
Risk summary
A missing critical flag on the HDMA clock in the SpacemiT K3 SoC clock driver allows the clock to be disabled, which hangs the system when the RISC-V core attempts TCM access (e.g., during a vector instruction page fault). Any local user with low privileges can trigger this system-wide denial of service. The vulnerability is limited to specific hardware configurations using the SpacemiT K3 SoC.
Vulnerability analysis
A clock gate for the HDMA path on the SpacemiT K3 RISC-V SoC was not marked as critical, allowing the common clock framework to disable it during routine power management or unused-clock gating. When disabled, the processor loses access to the internal TCM memory path, causing an unrecoverable system hang the next time the CPU needs that path, such as when handling a vector instruction page fault. The fix marks this clock with the critical flag so the framework never turns it off. The bug is reachable by any local user on affected SpacemiT K3 hardware whose actions cause the clock framework to gate the HDMA clock; no special privileges or network access are required to trigger the hang.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 7.0 | 7.1.10 | bb81b608db63 |
| mainline | 7.0 | 7.2 | eb525edd4890 |