---
id: CVE-2026-98903
title: 'mailbox: imx: Add a channel shutdown field'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mailbox: imx: Add a channel shutdown field

  sashiko complained about possible teardown problem. The scenario

   CPU 0                              CPU 1
    imx_mu_isr()  …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    02273054b2e94e53065ea5644265bb9d8f7ee2a7
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    944d8509c2220a2313d4a094a646507929fb6f8d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    5ccea7eacb7786c358833634f45700365f6c1d99
  - Linux < 6.12.111
  - Linux < 6.18.53
  - Linux (all versions)
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:54:15.010Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98903'
references:
  - url: 'https://git.kernel.org/stable/c/02273054b2e94e53065ea5644265bb9d8f7ee2a7'
  - url: 'https://git.kernel.org/stable/c/944d8509c2220a2313d4a094a646507929fb6f8d'
  - url: 'https://git.kernel.org/stable/c/5ccea7eacb7786c358833634f45700365f6c1d99'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.573Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mailbox: imx: Add a channel shutdown field

sashiko complained about possible teardown problem. The scenario

 CPU 0                              CPU 1
  imx_mu_isr()                   imx_mu_shutdown()
                                   imx_mu_xcr_rmw(priv, IMX_MU_RCR, 0, IMX_MU_xCR_RIEn(priv->dcfg->type, cp->idx));
    imx_mu_specific_rx()
      imx_mu_xcr_rmw(priv, IMX_MU_RCR, IMX_MU_xCR_RIEn(priv->dcfg->type, 0), 0);
                                   free_irq()

The RX event remains enabled because in this short window the RX event
was disabled in ->shutdown() while the interrupt was active and then
enabled again by the ISR while ->shutdown waited in free_irq().

This race requires timing and if happens can be problematic on shared
handlers if the "removed" channel triggers an interrupt. In this case
the irq-core will shutdown the interrupt with the "nobody cared"
message.

Introduce imx_mu_con_priv::shutdown to signal that the channel is
shutting down. This flag is set with the lock held (by
imx_mu_xcr_clr_shut()). The unmask side uses imx_mu_xcr_set_act() which
only enables the event if the channel has not been shutdown and
serialises on the same lock.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 02273054b2e94e53065ea5644265bb9d8f7ee2a7`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 944d8509c2220a2313d4a094a646507929fb6f8d`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5ccea7eacb7786c358833634f45700365f6c1d99`
- `Linux < 6.12.111`
- `Linux < 6.18.53`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.