CVE-2026-98904 mailbox: imx: Use devm_pm_runtime_enable()
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-98904?
CVE-2026-98904 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mailbox: imx: Use devm_pm_runtime_enable()
sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the removal path instead doing it early. This ensures that in an error case the device is removed (and imx_mu_shutdown()) before pm_runtime_disable() so we don't have to do this manually.
For the order to work, lets move devm_mbox_controller_register() until after the pm-runtime part. So the reverse order will be mbox-controller removal followed by disabling pm runtime.
Use devm_pm_runtime_enable(), remove manual pm_runtime_disable() invocations and move the pm_runtime handling in probe before devm_mbox_controller_register().
Which versions are affected by CVE-2026-98904?
How do I fix CVE-2026-98904?
Upgrade to a fixed version.
Is CVE-2026-98904 being exploited?
There is no known exploitation of CVE-2026-98904 in the wild and no public exploit code.
Sources
Also known as AZL-110579, BELL-CVE-2026-98904, DEBIAN-CVE-2026-98904, GHSA-6qfv-c5c2-gj3p, UBUNTU-CVE-2026-98904.