CVE-2026-80523

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80523", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.763Z", "datePublished": "2026-08-26T14:37:03.779Z", "dateUpdated": "2026-08-27T05:01:19.881Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:01:19.881Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: spacemit: k3: set hdma clock as critical\n\nHDMA clock is responsible for the internal TCM access path of X100 RISC-V\ncore, so set the clock flag as critical to prevent it from being shut off,\notherwise the Linux system will hang, for example in the case of a vector\ninstruction access generates a page fault."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local code execution on a SpacemiT K3 host to trigger RISC-V vector page faults through normal userspace memory access; the hdma_clk gate in drivers/clk/spacemit/ccu-k3.c is not reachable from network packets, Bluetooth, or physical USB interfaces.\nAC:L - On vulnerable K3 kernels the hdma_clk is deterministically disabled at boot by clk_disable_unused() because no driver claims CLK_DCIU_HDMA, and an unprivileged process can reliably hang the system with standard RVV workloads that fault on demand-paged mappings.\nPR:N - Triggering the hang needs only an unprivileged local process executing vector instructions that cause page faults (mmap/mprotect/stack growth); no CAP_SYS_ADMIN, init-namespace root, or user-namespace-only capabilities are required to reach the fault handler.\nUI:N - No victim interaction is required beyond the attacker running their own vector workload on the affected K3 system; the boot-time clock gating is automatic and the page fault is self-induced.\nS:C - On multi-tenant K3 edge, automotive, or containerized deployments, an unprivileged process in one container or application context can hang the shared kernel, denying availability to all other tenants and host services on the same SoC.\nC:N - The failure mode is a hardware-level system hang when TCM access stalls with HDMA clock gated; there is no out-of-bounds read, use-after-free, or information disclosure primitive in the bug or its documented trigger path.\nI:N - No kernel or user data is modified; impact is limited to freezing the system when vector page-fault handling cannot complete TCM accesses after hdma_clk was incorrectly shut off by the clock framework.\nA:H - The commit and reporter confirm the Linux system hangs (hard lockup requiring reset) when vector instruction accesses generate page faults while the HDMA clock providing the X100 core TCM access path has been gated off."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/spacemit/ccu-k3.c"], "versions": [{"version": "e371a77255b837f5d64c9d2520f87e41ea5350b9", "lessThan": "bb81b608db6342e5adccb6aabe900d739dc7cddb", "status": "affected", "versionType": "git"}, {"version": "e371a77255b837f5d64c9d2520f87e41ea5350b9", "lessThan": "eb525edd48907795c0d4e498ff57ad168070b289", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clk/spacemit/ccu-k3.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bb81b608db6342e5adccb6aabe900d739dc7cddb"}, {"url": "https://git.kernel.org/stable/c/eb525edd48907795c0d4e498ff57ad168070b289"}], "title": "clk: spacemit: k3: set hdma clock as critical", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/clk/spacemit/ccu-k3.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bb81b608db6342e5adccb6aabe900d739dc7cddb", "status": "affected", "version": "e371a77255b837f5d64c9d2520f87e41ea5350b9", "versionType": "git"}, {"lessThan": "eb525edd48907795c0d4e498ff57ad168070b289", "status": "affected", "version": "e371a77255b837f5d64c9d2520f87e41ea5350b9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/clk/spacemit/ccu-k3.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: spacemit: k3: set hdma clock as critical\n\nHDMA clock is responsible for the internal TCM access path of X100 RISC-V\ncore, so set the clock flag as critical to prevent it from being shut off,\notherwise the Linux system will hang, for example in the case of a vector\ninstruction access generates a page fault."}], "id": "CVE-2026-80523", "lastModified": "2026-08-27T06:17:31.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-26T15:17:05.940", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bb81b608db6342e5adccb6aabe900d739dc7cddb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eb525edd48907795c0d4e498ff57ad168070b289"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: clk: spacemit: k3: set hdma clock as critical", "id": "2524445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524445"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-909", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nclk: spacemit: k3: set hdma clock as critical\nHDMA clock is responsible for the internal TCM access path of X100 RISC-V\ncore, so set the clock flag as critical to prevent it from being shut off,\notherwise the Linux system will hang, for example in the case of a vector\ninstruction access generates a page fault.", "A flaw was found in the Linux kernel. The HDMA (Hardware Direct Memory Access) clock, responsible for the internal TCM (Tightly Coupled Memory) access path of the X100 RISC-V core, was not set as critical. This oversight allows the clock to be shut off, which can lead to a system hang, for example, when a vector instruction access generates a page fault. This vulnerability could result in a denial of service."], "name": "CVE-2026-80523", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80523\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80523\nhttps://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80523-34bb@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e371a77255b837f5d64c9d2520f87e41ea5350b9,bb81b608db6342e5adccb6aabe900d739dc7cddb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e371a77255b837f5d64c9d2520f87e41ea5350b9,eb525edd48907795c0d4e498ff57ad168070b289)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.10,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-26T16:45:08.071181+00:00", "updated": "2026-08-28T16:30:17.965562+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-703", "CWE-909"]}