CVE-2026-80523: Linux Kernel Spacemit K3 HDMA DOS Vulnerability

CVE-2026-80523 Overview

CVE-2026-80523 affects the Linux kernel's Spacemit K3 clock driver. The clk: spacemit: k3 component fails to mark the High-speed Direct Memory Access (HDMA) clock as critical. The HDMA clock governs the internal Tightly-Coupled Memory (TCM) access path for the X100 RISC-V core. When the kernel shuts down this clock, subsequent TCM accesses hang the system. A representative trigger is a vector instruction access that generates a page fault. The result is a local denial-of-service condition on affected RISC-V platforms.

Critical Impact
A local attacker or unprivileged workload can hang the entire Linux system by triggering a code path that requires HDMA-backed TCM access after the clock has been gated.

Affected Products

Linux kernel builds including the Spacemit K3 clock driver (clk: spacemit: k3)
Platforms using the Spacemit X100 RISC-V core with HDMA-backed TCM
RISC-V distributions shipping the vulnerable clock framework configuration

Discovery Timeline

2026-08-26 - CVE-2026-80523 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80523

Vulnerability Analysis

The Linux Common Clock Framework gates unused clocks by default to save power. The Spacemit K3 driver registered the HDMA clock without the CLK_IS_CRITICAL flag. The framework therefore treated the HDMA clock as eligible for shutdown when no consumer held a reference. The HDMA block, however, does not simply provide DMA services on this SoC. It also implements the internal access path to the TCM used by the X100 RISC-V core.

Once the HDMA clock is gated, any access that routes through the TCM path stalls indefinitely. The kernel commit description cites a vector instruction that generates a page fault as one reproducer. The fault handler reaches memory backed by TCM, and the CPU hangs because the transport clock is off. This is a kernel-side availability defect rather than a memory-safety issue, and it maps to a driver misconfiguration in the clock subsystem.

Root Cause

The root cause is a missing CLK_IS_CRITICAL flag on the HDMA clock registration in the Spacemit K3 driver. The clock framework's unused-clock cleanup logic then disables a clock that services architectural memory paths. The fix, applied in commits bb81b608db63 and eb525edd4890, sets the critical flag so the framework never gates the HDMA clock.

Attack Vector

Exploitation requires local execution on an affected Spacemit X100 RISC-V system. An attacker triggers any workload that causes the CPU to fetch from or fault into TCM-backed memory after the HDMA clock has been disabled. The referenced trigger is a vector instruction causing a page fault. The system hangs, denying service to all users. The vulnerability does not disclose data or allow code execution.

No synthetic exploitation code is provided. See the upstream commits for the driver-level fix.

Detection Methods for CVE-2026-80523

Indicators of Compromise

Unresponsive Spacemit X100 RISC-V systems following vector instruction execution or unusual page faults
Kernel logs stopping abruptly with no oops or panic message before hardware watchdog reset
clk_summary output in debugfs showing the HDMA clock disabled while the X100 core is active

Detection Strategies

Audit /sys/kernel/debug/clk/clk_summary on Spacemit K3 platforms to confirm the HDMA clock is enabled and referenced
Compare the running kernel's Spacemit K3 clock driver source against upstream commits bb81b608db63 and eb525edd4890
Correlate hardware watchdog resets with workloads that exercise RISC-V vector extensions or TCM-mapped regions

Monitoring Recommendations

Collect kernel ring buffer output and hardware watchdog events from Spacemit K3 fleets into a central log store
Alert on repeated unexplained soft lockups or hung task messages on RISC-V hosts
Track kernel package versions across RISC-V inventory to confirm patched builds are deployed

How to Mitigate CVE-2026-80523

Immediate Actions Required

Apply the upstream Linux kernel fix that sets the HDMA clock as critical in the Spacemit K3 driver
Rebuild and redeploy kernels for all Spacemit X100 RISC-V systems from patched sources
Restrict local access to affected devices until the fix is deployed, since the attack vector is local

Patch Information

The fix is available in the mainline Linux kernel via Kernel Git Commit Fix and Kernel Git Commit Update. The patch adds the CLK_IS_CRITICAL flag to the HDMA clock registration in the clk: spacemit: k3 driver, preventing the clock framework from gating it.

Workarounds

Disable the kernel's unused-clock cleanup by booting with clk_ignore_unused on affected RISC-V systems until the patched kernel is installed
Avoid workloads that exercise RISC-V vector instructions or TCM-mapped memory on unpatched systems
Pin the HDMA clock enabled from userspace or firmware where the platform allows explicit clock references

bash

# Add kernel command-line parameter to prevent unused-clock gating
# Example for U-Boot / extlinux on Spacemit X100 boards
append="console=ttyS0,115200 root=/dev/mmcblk0p2 rw clk_ignore_unused"