LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38633: clk: spacemit: mark K1 pll1_d8 as critical

In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: mark K1 pll1_d8 as critical The pll1_d8 clock is enabled by the boot loader, and is ultimately a parent for numerous clocks, including those used by APB and AXI buses. Guodong Xu discovered that this clock got disabled while responding to getting -EPROBE_DEFER when requesting a reset controller. The needed clock (CLK_DMA, along with its parents) had already been enabled. To respond to the probe deferral return, the CLK_DMA clock was disabled, and this led to parent clocks also reducing their enable count. When the enable count for pll1_d8 was decremented it became 0, which caused it to be disabled. This led to a system hang. Marking that clock critical resolves this by preventing it from being disabled. Define a new macro CCU_FACTOR_GATE_DEFINE() to allow clock flags to be supplied for a CCU_FACTOR_GATE clock.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel reliability flaw affecting Spacemit K1 systems. A required clock can be accidentally disabled during driver probing, causing the system to hang. The impact is availability, not data theft, based on the supplied sources.

Executive priority

Treat this as a targeted availability risk for Spacemit K1 platforms. It is not currently supported by evidence of active exploitation, but affected embedded or appliance systems should receive vendor-backed kernel fixes during normal stability patching.

Technical view

The Spacemit K1 clock driver allowed pll1_d8, a parent for APB and AXI bus clocks, to be disabled after an -EPROBE_DEFER path reduced clock enable counts. Marking pll1_d8 critical prevents shutdown and avoids a hang.

Likely exposure

Exposure appears limited to Linux kernels using the Spacemit K1 clock driver and the versions or commits listed in the CVE record. General Linux deployments without this hardware path are unlikely to be exposed.

Exploitation context

The supplied sources do not report active exploitation, KEV listing, exploit code, or remote attack conditions. The described trigger is an operational kernel driver probe path that can lead to a system hang.

Researcher notes

The key condition is clock enable-count unwinding after reset-controller probe deferral. The fix introduces a macro that permits flags on CCU_FACTOR_GATE clocks and marks pll1_d8 critical. Source evidence is strong for root cause and fix direction, limited for severity scoring.

Mitigation direction

  • Review vendor or distribution advisories for a kernel containing the referenced stable fixes.
  • Prioritize updates for Spacemit K1 devices or images running affected Linux kernel builds.
  • Avoid assuming generic Linux fleet exposure without confirming Spacemit K1 hardware or driver use.
  • Track downstream kernel package backports because source commit presence may differ from version numbers.

Validation and detection

  • Inventory systems for Spacemit K1 hardware or kernel configurations using the related clock driver.
  • Check running kernel versions against the CVE record and downstream distribution advisories.
  • Confirm whether the referenced stable commits are included in your kernel source or package changelog.
  • Review device hang incidents during boot or driver probing for correlation, without attempting reproduction in production.
Prepared
Confidence
high
Sources
4

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38633 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1b72c59db0add8e47fa116b21f78ed0b09a264f3, 1b72c59db0add8e47fa116b21f78ed0b09a264f3unaffected
LinuxLinux6.16, 0, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.