EUVD-2026-66589
GHSA-xwx3-g3pj-m9qw
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Local code execution required (AV:L); any low-privilege user can execute vector instructions (PR:L); kernel-wide hang changes scope (S:C); no confidentiality or integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
clk: spacemit: k3: set hdma clock as critical
HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will hang, for example in the case of a vector instruction access generates a page fault.
AnalysisAI
The SpacemiT K3 clock driver in the Linux kernel fails to mark the HDMA clock as CLK_IS_CRITICAL, allowing the kernel's Common Clock Framework to gate it during power management. On SpacemiT K3 SoCs running an X100 RISC-V core, this produces an irrecoverable system hang whenever TCM-dependent operations - such as page fault handling triggered by vector instructions - are attempted while the HDMA clock is inactive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires SpacemiT K3 SoC hardware with an X100 RISC-V core running a Linux kernel prior to 7.1.10 or before fix commit eb525edd / bb81b608. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-supplied CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) reflects a local, low-complexity denial-of-service with changed scope, but the PR:N metric is likely miscalibrated - triggering the vulnerability requires executing code on the local system, which implies at least a low-privilege account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a SpacemiT K3 system running an affected kernel, the runtime power manager gates the HDMA clock during an idle period. A subsequently launched user-space workload executing RISC-V vector instructions generates a page fault; the kernel fault handler traverses the TCM access path, finds the HDMA clock inactive, and the system hangs irrecoverably. … |
| Remediation | Upgrade to Linux kernel 7.1.10 or 7.2, which include the fix commits eb525edd48907795c0d4e498ff57ad168070b289 (https://git.kernel.org/stable/c/eb525edd48907795c0d4e498ff57ad168070b289) and bb81b608db6342e5adccb6aabe900d739dc7cddb (https://git.kernel.org/stable/c/bb81b608db6342e5adccb6aabe900d739dc7cddb) respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Linux on SpacemiT K3 SoCs and confirm kernel versions to identify affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today