Linux Kernel EUVD-2026-66589

Requires SpacemiT K3 SoC hardware with an X100 RISC-V core running a Linux kernel prior to 7.1.10 or before fix commit eb525edd / bb81b608. The hang is only reachable after the kernel's runtime power manager has gated the HDMA clock - a state reached during idle periods, not present immediately at boot. The immediate trigger is any RISC-V vector instruction that generates a page fault, executable by unprivileged user-space code. Exploitation is bounded by three factors: (1) specific SpacemiT K3 / X100 RISC-V hardware is mandatory, (2) the HDMA clock must already be in the gated state prior to the fault, and (3) a vector instruction page fault must occur after gating. Systems that have not undergone a clock-gating idle cycle since boot are not immediately vulnerable.

The NVD-supplied CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) reflects a local, low-complexity denial-of-service with changed scope, but the PR:N metric is likely miscalibrated - triggering the vulnerability requires executing code on the local system, which implies at least a low-privilege account. The Changed Scope (S:C) is appropriate because the resulting kernel hang terminates all user-space processes and renders the system unresponsive. No EPSS score was provided, there is no CISA KEV listing, and no public exploit has been identified at time of analysis, meaning real-world risk is substantially lower than the numerical score implies. Exploitation is doubly constrained: the hardware must be SpacemiT K3 with an X100 RISC-V core, and the HDMA clock must already have been gated by the power manager before the fault is triggered - a state-dependent condition not present at boot. The 'Information Disclosure' tag in the source data conflicts with the description and CVSS impact metrics (C:N/I:N/A:H) and appears to be a tagging error; this is a pure availability issue.

On a SpacemiT K3 system running an affected kernel, the runtime power manager gates the HDMA clock during an idle period. A subsequently launched user-space workload executing RISC-V vector instructions generates a page fault; the kernel fault handler traverses the TCM access path, finds the HDMA clock inactive, and the system hangs irrecoverably. No specially crafted exploit is required - ordinary execution of vector-capable code is sufficient once the clock has been gated.