Executive brief
The Linux kernel's clock management for Spacemit K3 processors contains a flaw where the HDMA (hardware DMA) clock can be incorrectly shut down, causing the system to hang. The HDMA clock is critical for the X100 RISC-V core's internal memory access path. When the clock is disabled—such as during power management operations—any vector instruction that triggers a page fault will cause the entire system to become unresponsive, resulting in a denial of service.
Technical details
The vulnerability is a denial-of-service due to improper clock gate configuration in the Spacemit K3 clock control unit driver (drivers/clk/spacemit/ccu-k3.c). The HDMA clock, responsible for the internal Tightly Coupled Memory (TCM) access path of the X100 RISC-V core, was not marked with the CLK_IS_CRITICAL flag, allowing the kernel's clock framework to disable it during idle power management. The attack vector is local and requires no special privileges—any page fault triggered during a vector instruction while the HDMA clock is disabled will hang the system. The fix marks the HDMA clock as critical, preventing the clock framework from disabling it. A patch is available in upstream Linux kernel commits eb525edd48907795c0d4e498ff57ad168070b289 and bb81b608db6342e5adccb6aabe900d739dc7cddb.
Affected products
- Linux Linux kernel Spacemit K3 clock driver (affected versions unspecified, patch available upstream)
Timeline
- 2026-08-26: disclosed
- 2026-07-06: patched: Upstream commit eb525edd48907795c0d4e498ff57ad168070b289
- 2026-08-23: patched: Stable backport commit bb81b608db6342e5adccb6aabe900d739dc7cddb