CVE Tools
Track your stack

CVE-2026-98903

mailbox: imx: Add a channel shutdown field

No known exploitation. No EPSS score yet. Fixed versions are out.

CVSS —Not scoredEPSS percentile—No score yetCISA KEVNot listedNo confirmed exploitation
No public exploit knownFix1 product4 fixed builds listed below

Published Updated Sources: CVE.org

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

  • LinuxAffected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 02273054b2e94e53065ea5644265bb9d8f7ee2a7Upgrade to: 02273054b2e94e53065ea5644265bb9d8f7ee2a7Affected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 944d8509c2220a2313d4a094a646507929fb6f8dUpgrade to: 944d8509c2220a2313d4a094a646507929fb6f8dAffected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 5ccea7eacb7786c358833634f45700365f6c1d99Upgrade to: 5ccea7eacb7786c358833634f45700365f6c1d99Affected: < 6.12.111Upgrade to: 6.12.111 + 1 more branchStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx_mu_isr() imx_mu_shutdown() imx_mu_xcr_rmw(priv, IMX_MU_RCR, 0, IMX_MU_xCR_RIEn(priv->dcfg->type, cp->idx)); imx_mu_specific_rx() imx_mu_xcr_rmw(priv, IMX_MU_RCR, IMX_MU_xCR_RIEn(priv->dcfg->type, 0), 0); free_irq() The RX event remains enabled because in this short window the RX event was disabled in ->shutdown() while the interrupt was active and then enabled again by the ISR while ->shutdown waited in free_irq(). This race requires timing and if happens can be problematic on shared handlers if the "removed" channel triggers an interrupt. In this case the irq-core will shutdown the interrupt with the "nobody cared" message. Introduce imx_mu_con_priv::shutdown to signal that the channel is shutting down. This flag is set with the lock held (by imx_mu_xcr_clr_shut()). The unmask side uses imx_mu_xcr_set_act() which only enables the event if the channel has not been shutdown and serialises on the same lock.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

No EPSS score yet. New CVEs are usually scored within a few days.

Affected products

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.