CVE-2026-98903: mailbox: imx: Add a channel shutdown field

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

mailbox: imx: Add a channel shutdown field

sashiko complained about possible teardown problem. The scenario

CPU 0 CPU 1 imxmuisr() imxmushutdown() imxmuxcrrmw(priv, IMXMURCR, 0, IMXMUxCRRIEn(priv->dcfg->type, cp->idx)); imxmuspecificrx() imxmuxcrrmw(priv, IMXMURCR, IMXMUxCRRIEn(priv->dcfg->type, 0), 0); freeirq()

The RX event remains enabled because in this short window the RX event was disabled in ->shutdown() while the interrupt was active and then enabled again by the ISR while ->shutdown waited in freeirq().

This race requires timing and if happens can be problematic on shared handlers if the "removed" channel triggers an interrupt. In this case the irq-core will shutdown the interrupt with the "nobody cared" message.

Introduce imxmuconpriv::shutdown to signal that the channel is shutting down. This flag is set with the lock held (by imxmuxcrclrshut()). The unmask side uses imxmuxcrsetact() which only enables the event if the channel has not been shutdown and serialises on the same lock.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 23, 2026

CVE Published

via MITRE·11:54 AM

Data Sourced

via MITRE·11:54 AM

Description

Frequently Asked Questions

Which systems are exposed to this race condition?

Systems using the Linux kernel i.MX Messaging Unit (imx_mu) mailbox driver are relevant. The issue concerns removal or shutdown of an RX channel on configurations using shared interrupt handlers.

What conditions are required for the issue to occur?

A narrow timing race must occur between the interrupt handler and channel shutdown: shutdown disables an RX event while an active ISR subsequently enables it again before free_irq() completes. If the removed channel then triggers an interrupt on a shared handler, irq-core can disable the interrupt with a "nobody cared" message.

How does the fix prevent the race?

The fix adds a per-channel shutdown flag. Shutdown sets the flag while holding the relevant lock, and the ISR-side unmask path uses the same lock and will enable the event only when the channel is not shutting down.

CVE-2026-98903: mailbox: imx: Add a channel shutdown field

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this race condition?

What conditions are required for the issue to occur?

How does the fix prevent the race?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this race condition?

What conditions are required for the issue to occur?

How does the fix prevent the race?