Cloudanix VulnDB

CVE-2026-98904

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A startup ordering problem in a Linux driver for certain processor communication hardware could leave devices in an unsafe state if initialization fails.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits device access before mailbox probe completes because pm_runtime_enable is invoked too early and manual pm_runtime_disable calls are not guaranteed on error paths, creating a race condition between mbox-controller registration and runtime power management.

Why it matters to the business

Systems using i.MX mailbox hardware may experience probe failures, unexpected device state, or kernel instability during driver load or unload, increasing operational risk for affected embedded Linux deployments.

How an attack unfolds

An attacker with local access triggers repeated probe attempts or forces error conditions during driver initialization to exploit the ordering issue between runtime power management and mailbox registration, potentially leading to use-after-free or improper device state.

How to fix it

Apply the upstream kernel commit that replaces manual pm_runtime handling with devm_pm_runtime_enable and reorders devm_mbox_controller_register after the runtime setup.

How to confirm the fix worked

Confirm the driver source contains devm_pm_runtime_enable after pm_runtime setup and before mbox registration, and verify absence of manual pm_runtime_disable calls in the imx mailbox probe path.

Typical attack path

  1. Obtain local access on target system
  2. Trigger mailbox driver probe via module load or hardware event
  3. Force probe error path before mbox registration completes
  4. Observe or manipulate device state due to premature runtime enable

How to detect it

Review kernel logs for mailbox probe errors or warnings around pm_runtime calls; inspect crash dumps or dmesg for traces involving imx_mu_shutdown or mbox_controller_register during module insertion.

What your security team should do

  • Prioritize kernel updates containing this fix on all i.MX-based systems
  • Monitor for new stable kernel releases in the affected series
  • Test driver load/unload sequences in staging environments after patching

The record

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the removal path instead doing it early. This ensures that in an error case the device is removed (and imx_mu_shutdown()) before pm_runtime_disable() so we don't have to do this manually. For the order to work, lets move devm_mbox_controller_register() until after the pm-runtime part. So the reverse order will be mbox-controller removal followed by disabling pm runtime. Use devm_pm_runtime_enable(), remove manual pm_runtime_disable() invocations and move the pm_runtime handling in probe before devm_mbox_controller_register().

Affected packages

Ecosystem Package Introduced Fixed