mailbox: imx: Use devm_pm_runtime_enable()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.111, 6.18.53
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's mailbox driver for NXP i.MX processors could use the device before its probe had finished, and it could tear down power management in the wrong order when errors occurred. This could leave the device in an inconsistent state during initialization or removal.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the removal path instead doing it early. This ensures that in an error case the device is removed (and imx_mu_shutdown()) before pm_runtime_disable() so we don't have to do this manually. For the order to work, lets move devm_mbox_controller_register() until after the pm-runtime part. So the reverse order will be mbox-controller removal followed by disabling pm runtime. Use devm_pm_runtime_enable(), remove manual pm_runtime_disable() invocations and move the pm_runtime handling in probe before devm_mbox_controller_register().
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- Linux Linux
From 676f23eab75adbf72c029bdfb7b5a7b2f1129177 · fixed in b30a047744ea4344bb6f854b0a052cf276349128; From 676f23eab75adbf72c029bdfb7b5a7b2f1129177 · fixed in adcaa21d50c3a4c884f4d0b7a95fa3bd7a07cf84; From 676f23eab75adbf72c029bdfb7b5a7b2f1129177 · fixed in 1f602619e408b6e9655ee76656a2a5ab6e89c5e4
- Linux Linux
5.8
- KernelLinux
fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53