CVE-2026-80523 (GCVE-0-2026-80523)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
clk: spacemit: k3: set hdma clock as critical
Summary
In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will hang, for example in the case of a vector instruction access generates a page fault.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e371a77255b837f5d64c9d2520f87e41ea5350b9 , < bb81b608db6342e5adccb6aabe900d739dc7cddb (git)
Affected: e371a77255b837f5d64c9d2520f87e41ea5350b9 , < eb525edd48907795c0d4e498ff57ad168070b289 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/spacemit/ccu-k3.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bb81b608db6342e5adccb6aabe900d739dc7cddb",
              "status": "affected",
              "version": "e371a77255b837f5d64c9d2520f87e41ea5350b9",
              "versionType": "git"
            },
            {
              "lessThan": "eb525edd48907795c0d4e498ff57ad168070b289",
              "status": "affected",
              "version": "e371a77255b837f5d64c9d2520f87e41ea5350b9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/spacemit/ccu-k3.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: spacemit: k3: set hdma clock as critical\n\nHDMA clock is responsible for the internal TCM access path of X100 RISC-V\ncore, so set the clock flag as critical to prevent it from being shut off,\notherwise the Linux system will hang, for example in the case of a vector\ninstruction access generates a page fault."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local code execution on a SpacemiT K3 host to trigger RISC-V vector page faults through normal userspace memory access; the hdma_clk gate in drivers/clk/spacemit/ccu-k3.c is not reachable from network packets, Bluetooth, or physical USB interfaces.\nAC:L - On vulnerable K3 kernels the hdma_clk is deterministically disabled at boot by clk_disable_unused() because no driver claims CLK_DCIU_HDMA, and an unprivileged process can reliably hang the system with standard RVV workloads that fault on demand-paged mappings.\nPR:N - Triggering the hang needs only an unprivileged local process executing vector instructions that cause page faults (mmap/mprotect/stack growth); no CAP_SYS_ADMIN, init-namespace root, or user-namespace-only capabilities are required to reach the fault handler.\nUI:N - No victim interaction is required beyond the attacker running their own vector workload on the affected K3 system; the boot-time clock gating is automatic and the page fault is self-induced.\nS:C - On multi-tenant K3 edge, automotive, or containerized deployments, an unprivileged process in one container or application context can hang the shared kernel, denying availability to all other tenants and host services on the same SoC.\nC:N - The failure mode is a hardware-level system hang when TCM access stalls with HDMA clock gated; there is no out-of-bounds read, use-after-free, or information disclosure primitive in the bug or its documented trigger path.\nI:N - No kernel or user data is modified; impact is limited to freezing the system when vector page-fault handling cannot complete TCM accesses after hdma_clk was incorrectly shut off by the clock framework.\nA:H - The commit and reporter confirm the Linux system hangs (hard lockup requiring reset) when vector instruction accesses generate page faults while the HDMA clock providing the X100 core TCM access path has been gated off."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:19.881Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bb81b608db6342e5adccb6aabe900d739dc7cddb"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb525edd48907795c0d4e498ff57ad168070b289"
        }
      ],
      "title": "clk: spacemit: k3: set hdma clock as critical",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80523",
    "datePublished": "2026-08-26T14:37:03.779Z",
    "dateReserved": "2026-08-26T14:34:25.763Z",
    "dateUpdated": "2026-08-27T05:01:19.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80523",
      "date": "2026-09-01",
      "epss": "0.00125",
      "percentile": "0.02515"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80523\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:05.940\",\"lastModified\":\"2026-08-27T06:17:31.467\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclk: spacemit: k3: set hdma clock as critical\\n\\nHDMA clock is responsible for the internal TCM access path of X100 RISC-V\\ncore, so set the clock flag as critical to prevent it from being shut off,\\notherwise the Linux system will hang, for example in the case of a vector\\ninstruction access generates a page fault.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/clk/spacemit/ccu-k3.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e371a77255b837f5d64c9d2520f87e41ea5350b9\",\"lessThan\":\"bb81b608db6342e5adccb6aabe900d739dc7cddb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e371a77255b837f5d64c9d2520f87e41ea5350b9\",\"lessThan\":\"eb525edd48907795c0d4e498ff57ad168070b289\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/clk/spacemit/ccu-k3.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":4.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/bb81b608db6342e5adccb6aabe900d739dc7cddb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eb525edd48907795c0d4e498ff57ad168070b289\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-27T08:49:43+00:00",
      "cve": "CVE-2026-80523",
      "id": "CVE-2026-80523",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: clk: spacemit: k3: set hdma clock as critical",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80523.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.