CVE-2026-98904 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
mailbox: imx: Use devm_pm_runtime_enable()
sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the removal path instead doing it early. This ensures that in an error case the device is removed (and imx_mu_shutdown()) before pm_runtime_disable() so we don't have to do this manually.
For the order to work, lets move devm_mbox_controller_register() until after the pm-runtime part. So the reverse order will be mbox-controller removal followed by disabling pm runtime.
Use devm_pm_runtime_enable(), remove manual pm_runtime_disable() invocations and move the pm_runtime handling in probe before devm_mbox_controller_register().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel driver for i.MX Mailboxes contains a resource management flaw related to power management initialization during device probing. Specifically, the original implementation invoked pm_runtime_enable early within the probe function, which can lead to premature activation of the device before its full initialization is complete. This timing issue was flagged by developers as problematic because it allows potential access or operations on hardware resources that are not yet fully configured, potentially causing instability or undefined behavior if an error occurs during subsequent setup steps. The core technical flaw lies in the ordering and lifecycle management of power runtime states relative to device registration and cleanup routines.
To address this vulnerability, the fix restructures the initialization sequence by utilizing devm_pm_runtime_enable instead of manual pm_runtime calls. This change ensures that power management enablement is tied directly to the device resource management framework, which automatically handles cleanup in reverse order during removal. By moving the pm-runtime handling logic before the registration of the mailbox controller via devm_mbox_controller_register, the driver guarantees a strict dependency chain where the controller must be properly registered and operational before runtime PM is enabled. This ordering prevents scenarios where power state changes occur while critical subsystems are still being initialized or if an error path triggers early termination without proper teardown sequences.
The operational impact of this vulnerability includes potential system instability due to premature hardware access, as well as increased complexity in manual resource cleanup paths that were previously required to handle edge cases during probe failures. The previous approach necessitated explicit calls to pm_runtime_disable in various error handling branches and the removal path, increasing the risk of race conditions or missed cleanup steps if a code path was overlooked. By adopting managed resources, the driver simplifies its lifecycle management, ensuring that imx_mu_shutdown is called before pm_runtime_disable when errors occur during probe. This reduces boilerplate code and minimizes the attack surface associated with improper resource state transitions.
From a security perspective, this issue aligns with CWE-672 regarding the use of outside-controlled variables or resources without proper validation, specifically in the context of initialization order dependencies that can lead to inconsistent states. It also relates to ATT&CK techniques involving system configuration changes that could be exploited if an attacker triggers early probe failures to manipulate power state assumptions. The mitigation involves adhering strictly to managed resource patterns provided by the kernel devm framework, which enforces deterministic cleanup and prevents dangling references or stale power states. Developers should ensure that all hardware-specific initialization completes before enabling runtime power management features to maintain system integrity and prevent exploitation of timing windows during device setup phases.