Incorrect behavior order in Linux kernel - CVE-2026-98904

Vulnerability identifier: #VU157605

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98904

CWE-ID: CWE-696

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to potentially disrupt device operation and cause a denial of service.

The vulnerability exists due to incorrect initialization and cleanup ordering in the Linux kernel i.MX mailbox driver when the device is used before probe completion or runtime power management is disabled before mailbox shutdown. A local user can potentially exercise the device during these lifecycle transitions to disrupt device operation and cause a denial of service.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/1f602619e408b6e9655ee76656a2a5ab6e89c5e4
• https://git.kernel.org/stable/c/adcaa21d50c3a4c884f4d0b7a95fa3bd7a07cf84
• https://git.kernel.org/stable/c/b30a047744ea4344bb6f854b0a052cf276349128

• Incorrect behavior order in Linux kernel mailbox driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more