{"id":"CVE-2026-98903","kind":"vulnerability","aliases":["CVE-2026-98903"],"related":[],"title":"Linux kernel: i.MX mailbox shutdown race can leave interrupt enabled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: imx: Add a channel shutdown field\n\nsashiko complained about possible teardown problem. The scenario\n\n CPU 0                              CPU 1\n  imx_mu_isr()                   imx_mu_shutdown()\n                                   imx_mu_xcr_rmw(priv, IMX_MU_RCR, 0, IMX_MU_xCR_RIEn(priv->dcfg->type, cp->idx));\n    imx_mu_specific_rx()\n      imx_mu_xcr_rmw(priv, IMX_MU_RCR, IMX_MU_xCR_RIEn(priv->dcfg->type, 0), 0);\n                                   free_irq()\n\nThe RX event remains enabled because in this short window the RX event\nwas disabled in ->shutdown() while the interrupt was active and then\nenabled again by the ISR while ->shutdown waited in free_irq().\n\nThis race requires timing and if happens can be problematic on shared\nhandlers if the \"removed\" channel triggers an interrupt. In this case\nthe irq-core will shutdown the interrupt with the \"nobody cared\"\nmessage.\n\nIntroduce imx_mu_con_priv::shutdown to signal that the channel is\nshutting down. This flag is set with the lock held (by\nimx_mu_xcr_clr_shut()). The unmask side uses imx_mu_xcr_set_act() which\nonly enables the event if the channel has not been shutdown and\nserialises on the same lock.","summary":"A race in the i.MX mailbox driver can leave a receive interrupt enabled after a channel is shut down, which can trigger spurious interrupts on shared handlers. The sources describe a teardown timing issue, not a confirmed code execution or data exposure path.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["i.mx","linux","mailbox","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:59:51+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T04:59:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: i.MX mailbox shutdown race can leave interrupt enabled","impact":"low","summary":"A race in the i.MX mailbox driver can leave a receive interrupt enabled after a channel is shut down, which can trigger spurious interrupts on shared handlers. The sources describe a teardown timing issue, not a confirmed code execution or data exposure path.","category":"other","nicknames":[],"who_cares":["linux","i.mx","mailbox"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the upstream kernel commit and the affected stable kernel version ranges at https://nvd.nist.gov/vuln/detail/CVE-2026-98903 to fill in fix and how_to_check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000554,"input_tokens":3716,"output_tokens":364,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98903':13A,16A '0':89C,106C,135C,136C '1':91C 'act':246C 'activ':160C 'add':75C 'care':208C 'case':196C 'channel':35B,77C,190C,220C,254C 'clr':236C 'code':57B 'complain':81C 'con':213C 'confirm':56B 'core':200C 'cp':114C 'cpu':88C,90C 'cve':11A,14A 'data':60B 'dcfg':112C,133C 'describ':49B 'disabl':153C 'driver':26B 'enabl':10A,32B,143C,163C,249C 'event':141C,151C,251C 'execut':58B 'exposur':61B 'field':79C 'flag':225C 'follow':68C 'free':137C,172C 'handler':46B,186C 'happen':180C 'held':231C 'i.mx':3A,17B,24B 'idx':115C 'imx':74C,92C,95C,98C,103C,107C,116C,120C,125C,128C,211C,233C,242C 'interrupt':9A,31B,43B,158C,193C,204C 'introduc':210C 'irq':138C,173C,199C 'irq-cor':198C 'isr':94C,167C 'issu':53B 'kernel':2A,66C 'leav':8A,28B 'linux':1A,18B,65C 'lock':230C,264C 'mailbox':4A,19B,25B,73C 'messag':209C 'mu':93C,96C,99C,104C,108C,117C,121C,126C,129C,212C,234C,243C 'nobodi':207C 'path':62B 'possibl':83C 'priv':102C,111C,124C,132C,214C 'problem':85C 'problemat':183C 'race':6A,21B,175C 'rcr':105C,127C 'receiv':30B 'remain':142C 'remov':189C 'requir':176C 'resolv':72C 'rien':110C,131C 'rmw':101C,123C 'rx':119C,140C,150C 'sashiko':80C 'scenario':87C 'serialis':260C 'set':227C,245C 'share':45B,185C 'short':147C 'shut':37B,222C,237C 'shutdown':5A,78C,97C,155C,169C,202C,215C,258C 'side':240C 'signal':217C 'sourc':48B 'specif':118C 'spurious':42B 'teardown':51B,84C 'time':52B,177C 'trigger':41B,191C 'type':113C,134C 'unmask':239C 'use':241C 'vulner':69C 'wait':170C 'window':148C 'xcr':100C,109C,122C,130C,235C,244C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98903","severity":null,"published_at":"2026-10-23T12:18:24+00:00","modified_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98903","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98903","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}