CVE Tools
Track your stack

CVE-2026-98904

mailbox: imx: Use devm_pm_runtime_enable()

No known exploitation. No EPSS score yet. Fixed versions are out.

CVSS —Not scoredEPSS percentile—No score yetCISA KEVNot listedNo confirmed exploitation
No public exploit knownFix1 product4 fixed builds listed below

Published Updated Sources: CVE.org

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

  • LinuxAffected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b30a047744ea4344bb6f854b0a052cf276349128Upgrade to: b30a047744ea4344bb6f854b0a052cf276349128Affected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < adcaa21d50c3a4c884f4d0b7a95fa3bd7a07cf84Upgrade to: adcaa21d50c3a4c884f4d0b7a95fa3bd7a07cf84Affected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1f602619e408b6e9655ee76656a2a5ab6e89c5e4Upgrade to: 1f602619e408b6e9655ee76656a2a5ab6e89c5e4Affected: < 6.12.111Upgrade to: 6.12.111 + 1 more branchStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the removal path instead doing it early. This ensures that in an error case the device is removed (and imx_mu_shutdown()) before pm_runtime_disable() so we don't have to do this manually. For the order to work, lets move devm_mbox_controller_register() until after the pm-runtime part. So the reverse order will be mbox-controller removal followed by disabling pm runtime. Use devm_pm_runtime_enable(), remove manual pm_runtime_disable() invocations and move the pm_runtime handling in probe before devm_mbox_controller_register().

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

No EPSS score yet. New CVEs are usually scored within a few days.

Affected products

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.