{"id":"CVE-2026-98904","kind":"vulnerability","aliases":["CVE-2026-98904"],"related":[],"title":"Linux kernel: i.MX mailbox driver probe ordering fix for runtime PM","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: imx: Use devm_pm_runtime_enable()\n\nsashiko complained about early usage of the device while probe isn't\ncompleted. This can be mitigated by delaying the pm_runtime_enable()\ninto the removal path instead doing it early. This ensures that in an\nerror case the device is removed (and imx_mu_shutdown()) before\npm_runtime_disable() so we don't have to do this manually.\n\nFor the order to work, lets move devm_mbox_controller_register() until\nafter the pm-runtime part. So the reverse order will be mbox-controller\nremoval followed by disabling pm runtime.\n\nUse devm_pm_runtime_enable(), remove manual pm_runtime_disable()\ninvocations and move the pm_runtime handling in probe before\ndevm_mbox_controller_register().","summary":"This is a Linux kernel change to the i.MX mailbox driver that moves runtime PM enable and teardown into devm-managed cleanup so the device is not used before probe completes. The sources describe a probe-ordering and resource-cleanup correction, and do not describe an attacker-reachable impact.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["imx-mailbox","linux-kernel","package"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:59:51+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.3,"triage":{"at":"2026-10-25T04:59:51Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Linux kernel: i.MX mailbox driver probe ordering fix for runtime PM","impact":"low","summary":"This is a Linux kernel change to the i.MX mailbox driver that moves runtime PM enable and teardown into devm-managed cleanup so the device is not used before probe completes. The sources describe a probe-ordering and resource-cleanup correction, and do not describe an attacker-reachable impact.","category":"package","nicknames":[],"who_cares":["linux-kernel","imx-mailbox"],"confidence":0.3,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit to confirm whether any exploitable impact exists and which kernel versions contain the fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000533,"input_tokens":3501,"output_tokens":365,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98904':14A,17A 'attack':75B 'attacker-reach':74B 'case':132C 'chang':30B 'cleanup':47B,67B 'complain':96C 'complet':56B,107C 'control':163C,180C,209C 'correct':68B 'cve':12A,15A 'delay':113C 'describ':59B,72B 'devic':50B,102C,134C 'devm':45B,91C,161C,188C,207C 'devm-manag':44B 'disabl':144C,184C,196C 'driver':5A,35B 'earli':98C,125C 'enabl':40B,94C,117C,191C 'ensur':127C 'error':131C 'fix':8A 'follow':83C,182C 'handl':203C 'i.mx':3A,33B 'impact':77B 'imx':19B,89C,138C 'imx-mailbox':18B 'instead':122C 'invoc':197C 'isn':105C 'kernel':2A,23B,29B,81C 'let':159C 'linux':1A,22B,28B,80C 'linux-kernel':21B 'mailbox':4A,20B,34B,88C 'manag':46B 'manual':153C,193C 'mbox':162C,179C,208C 'mbox-control':178C 'mitig':111C 'move':37B,160C,199C 'mu':139C 'order':7A,63B,156C,175C 'packag':24B 'part':171C 'path':121C 'pm':11A,39B,92C,115C,142C,169C,185C,189C,194C,201C 'pm-runtim':168C 'probe':6A,55B,62B,104C,205C 'probe-ord':61B 'reachabl':76B 'regist':164C,210C 'remov':120C,136C,181C,192C 'resolv':87C 'resourc':66B 'resource-cleanup':65B 'revers':174C 'runtim':10A,38B,93C,116C,143C,170C,186C,190C,195C,202C 'sashiko':95C 'shutdown':140C 'sourc':58B 'teardown':42B 'usag':99C 'use':53B,90C,187C 'vulner':84C 'work':158C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98904","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98904","severity":null,"published_at":"2026-10-23T12:18:24+00:00","modified_at":"2026-10-23T12:18:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98904","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98904","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}