CVE-2025-38633: clk: spacemit: mark K1 pll1_d8 as critical
In the Linux kernel, the following vulnerability has been resolved:
clk: spacemit: mark K1 pll1_d8 as critical
The pll1_d8 clock is enabled by the boot loader, and is ultimately a
parent for numerous clocks, including those used by APB and AXI buses.
Guodong Xu discovered that this clock got disabled while responding to
getting -EPROBE_DEFER when requesting a reset controller.
The needed clock (CLK_DMA, along with its parents) had already been
enabled. To respond to the probe deferral return, the CLK_DMA clock
was disabled, and this led to parent clocks also reducing their enable
count. When the enable count for pll1_d8 was decremented it became 0,
which caused it to be disabled. This led to a system hang.
Marking that clock critical resolves this by preventing it from being
disabled.
Define a new macro CCU_FACTOR_GATE_DEFINE() to allow clock flags to
be supplied for a CCU_FACTOR_GATE clock.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel reliability flaw affecting Spacemit K1 systems. A required clock can be accidentally disabled during driver probing, causing the system to hang. The impact is availability, not data theft, based on the supplied sources.
Executive priority
Treat this as a targeted availability risk for Spacemit K1 platforms. It is not currently supported by evidence of active exploitation, but affected embedded or appliance systems should receive vendor-backed kernel fixes during normal stability patching.
Technical view
The Spacemit K1 clock driver allowed pll1_d8, a parent for APB and AXI bus clocks, to be disabled after an -EPROBE_DEFER path reduced clock enable counts. Marking pll1_d8 critical prevents shutdown and avoids a hang.
Likely exposure
Exposure appears limited to Linux kernels using the Spacemit K1 clock driver and the versions or commits listed in the CVE record. General Linux deployments without this hardware path are unlikely to be exposed.
Exploitation context
The supplied sources do not report active exploitation, KEV listing, exploit code, or remote attack conditions. The described trigger is an operational kernel driver probe path that can lead to a system hang.
Researcher notes
The key condition is clock enable-count unwinding after reset-controller probe deferral. The fix introduces a macro that permits flags on CCU_FACTOR_GATE clocks and marks pll1_d8 critical. Source evidence is strong for root cause and fix direction, limited for severity scoring.
Mitigation direction
Review vendor or distribution advisories for a kernel containing the referenced stable fixes.
Prioritize updates for Spacemit K1 devices or images running affected Linux kernel builds.
Avoid assuming generic Linux fleet exposure without confirming Spacemit K1 hardware or driver use.
Track downstream kernel package backports because source commit presence may differ from version numbers.
Validation and detection
Inventory systems for Spacemit K1 hardware or kernel configurations using the related clock driver.
Check running kernel versions against the CVE record and downstream distribution advisories.
Confirm whether the referenced stable commits are included in your kernel source or package changelog.
Review device hang incidents during boot or driver probing for correlation, without attempting reproduction in production.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-38633 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
3Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Aug 22, 2025, 16:00 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.