SB2026102419 - Incorrect behavior order in Linux kernel mailbox driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect behavior order (CVE-ID: CVE-2026-98904)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt device operation and cause a denial of service.

The vulnerability exists due to incorrect initialization and cleanup ordering in the Linux kernel i.MX mailbox driver when the device is used before probe completion or runtime power management is disabled before mailbox shutdown. A local user can potentially exercise the device during these lifecycle transitions to disrupt device operation and cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1f602619e408b6e9655ee76656a2a5ab6e89c5e4
• https://git.kernel.org/stable/c/adcaa21d50c3a4c884f4d0b7a95fa3bd7a07cf84
• https://git.kernel.org/stable/c/b30a047744ea4344bb6f854b0a052cf276349128