CVE-2025-68318 clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL
A missing critical clock flag in the TH1520 AXI driver allows clock gating to cause bus timeouts, leading to system hangs and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68318?
CVE-2025-68318 is a denial of service vulnerability in Linux, published on 16 Dec 2025.
Official description
In the Linux kernel, the following vulnerability has been resolved:
clk: thead: th1520-ap: set all AXI clocks to CLK_IS_CRITICAL
The AXI crossbar of TH1520 has no proper timeout handling, which means gating AXI clocks can easily lead to bus timeout and thus system hang.
Set all AXI clock gates to CLK_IS_CRITICAL. All these clock gates are ungated by default on system reset.
In addition, convert all current CLK_IGNORE_UNUSED usage to CLK_IS_CRITICAL to prevent unwanted clock gating.
Which versions are affected by CVE-2025-68318?
How do I fix CVE-2025-68318?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-68318 being exploited?
There is no known exploitation of CVE-2025-68318 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68318, DEBIAN-CVE-2025-68318, GHSA-35v6-xwx8-cj7m, ROOT-OS-DEBIAN-13-CVE-2025-68318, ROOT-OS-UBUNTU-2204-CVE-2025-68318, ROOT-OS-UBUNTU-2404-CVE-2025-68318 and 1 more.