CVE-2025-38633: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-38633 is a vulnerability in the Linux kernel's clock subsystem affecting SpaceMit K1 processors, where the critical pll1_d8 clock can be inadvertently disabled during probe deferral handling, leading to a system hang. The issue was discovered by Guodong Xu and publicly disclosed on August 22, 2025. It affects Linux kernel version 6.16, with patches available targeting the 6.16.1 and 6.17-rc1 release lines. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is improper clock lifecycle management (CWE-400, Uncontrolled Resource Consumption) in the clk: spacemit driver for the SpaceMit K1 SoC. The pll1_d8 clock is enabled by the bootloader and serves as a parent for numerous critical clocks, including those driving the APB and AXI buses. When the DMA driver requests a reset controller and receives -EPROBE_DEFER, the kernel disables CLK_DMA and propagates the disable up the clock tree, decrementing the enable count of pll1_d8 to zero and causing it to be gated off. The fix marks pll1_d8 as a critical clock using a new CCU_FACTOR_GATE_DEFINE() macro, preventing it from being disabled regardless of reference count (Kernel Patch 1, Kernel Patch 2).

Successful exploitation causes a complete system hang, rendering the affected device fully unresponsive. The availability impact is high, as disabling pll1_d8 cuts off clock signals to APB and AXI buses, which are fundamental to SoC operation. There is no confidentiality or integrity impact; the vulnerability is purely a denial-of-service condition affecting systems running SpaceMit K1-based hardware with Linux kernel 6.16 (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires low-privileged local access to trigger, and the EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Apply the upstream kernel patches that mark pll1_d8 as a critical clock, available for Linux kernel 6.16.1 and 6.17-rc1. The relevant commits are 10948c00e548e9ad2ce9d765baf26dce2d9b806b and 7554729de27daf6d54bcf8689d863bbe267828bf on git.kernel.org. As a temporary workaround on affected SpaceMit K1 systems, administrators can monitor for unexpected system hangs during boot or driver probe sequences and ensure the DMA driver and reset controller are properly initialized before other dependent drivers (Kernel Patch 1, Kernel Patch 2).