Description

In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will hang, for example in the case of a vector instruction access generates a page fault.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-26T15:17:05.940Z",
  "pubdate": "2026-08-26T15:17:05.940Z",
  "executiveSummary": "This vulnerability involves the improper clock management within the Spacemit K3 clock driver in the Linux kernel, leading to a critical system instability issue.\nThe HDMA clock, which facilitates the internal TCM (Tightly Coupled Memory) access path for the X100 RISC-V core, is incorrectly treated as a standard peripheral clock rather than a critical system resource.\nThe vulnerability type is a Denial of Service (DoS) resulting from improper resource management. If the kernel attempts to gate or disable the HDMA clock—particularly during error handling routines such as vector instruction page faults—the system encounters an unrecoverable hang.\nThe impact is a full system freeze, requiring a hardware power cycle. This issue affects Spacemit K3-based Linux kernel deployments. No authentication or elevated privileges are required for an attacker to trigger the conditions that lead to this hang if they can induce the necessary fault conditions.\nThe risk implication is high for embedded systems where stability is critical, as transient execution errors (like specific memory access violations) transition from manageable kernel exceptions to total system failure.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper registration of the HDMA clock within the Spacemit K3 clock framework. In the Linux Common Clock Framework (CCF), clocks that are essential for the integrity of the SoC's internal data paths must be marked with the CLK_IS_CRITICAL flag to prevent the kernel's clock gating logic from disabling them during idle periods or power management transitions.\nThe X100 RISC-V core relies on the HDMA (High-speed Direct Memory Access/internal path) for TCM access. TCM is a low-latency, tightly coupled memory interface often utilized by high-performance RISC-V cores for low-latency instruction or data fetch operations. By failing to mark this clock as critical, the kernel treats it as a gateable resource.\nThe exploit flow occurs during high-stress scenarios or specific exception handling. For instance, when a vector instruction access generates a page fault, the kernel exception handler attempts to resolve the fault. If the system power management subsystem or a clock management policy determines that the HDMA clock is unused or eligible for gating during this state, the clock signal is disabled.\nOnce the HDMA clock is gated, any subsequent attempt by the X100 core to access the TCM—required to finalize the page fault resolution or complete the instruction execution—results in a synchronous bus error or a complete stall of the processing pipeline. Because the hardware path required to recover from the exception is effectively 'darkened,' the CPU can no longer make forward progress, resulting in a permanent kernel hang.\nThis vulnerability is triggered by internal state changes within the kernel, specifically during memory management operations. While primarily a stability issue, it functions as a local DoS primitive. An attacker capable of influencing user-space memory access patterns—such as triggering specific vector instruction memory faults—can force the kernel into an execution path where the clock gating logic is invoked while the hardware dependency is active, effectively causing the system to lock up.\nThe issue exists within the clk-spacemit-k3 driver component. Exploitation does not require network exposure; it is entirely local and mediated by the kernel's internal state machine for power and clock gating."
}