CVE-2026-23116

What it actually does

The flaw permits a local process to trigger separate reset or clock operations on G1/G2 VPU units of the i.MX8MQ VPUMIX domain; because the ADB lacks independent rst/clk bits, these operations cause the domain to hang.

Why it matters to the business

Systems using the i.MX8MQ SoC can experience complete unresponsiveness requiring a power cycle, interrupting workloads and availability on affected embedded or edge Linux devices.

How an attack unfolds

An attacker with local access invokes the VPU power notifier or blk-ctrl operations that attempt independent G1 or G2 reset/clock gating; the hardware cannot satisfy the request, resulting in a domain-level hang.

How to fix it

Upgrade the Linux kernel to a revision containing commit 8859e336d233e61a4c40d40dc6a9f21e8b9b719c, which removes the separate rst_mask and clk_mask fields from imx8mq_vpu_blk_ctl_domain_data and lets the power notifier perform the combined reset.

How to confirm the fix worked

Confirm the running kernel tree contains commit 8859e336d233e61a4c40d40dc6a9f21e8b9b719c; inspect the imx8m-blk-ctrl driver to verify absence of rst_mask/clk_mask for the 8mq VPU domain and that imx8mq_vpu_power_notifier performs the reset.

Typical attack path

1. Obtain a local shell or process on an i.MX8MQ Linux system
2. Trigger VPU power-domain or blk-ctrl reset paths
3. Request separate reset or clock mask operations for G1 or G2
4. Induce system-wide hang

How to detect it

Review kernel logs for imx8m-blk-ctrl or VPU power-domain errors preceding a hang; examine dmesg or journalctl for references to separate VPU reset attempts on i.MX8MQ platforms.

What your security team should do

• Apply the referenced kernel commit on all i.MX8MQ deployments
• Reboot affected systems after the update
• Monitor vendor stable branches for back-ports