CVE-2024-56618 is a vulnerability identified in the Linux kernel, specifically affecting the power management domain (pmdomain) implementation for the i.MX8M Plus (imx8mp) platform. The issue arises from an insufficient delay (udelay(5)) after the power-up handshake sequence in the gpcv2 power controller driver. This inadequate delay can lead to a race condition where the kernel attempts to resume runtime power management before the hardware is fully ready, resulting in an asynchronous SError interrupt and causing a kernel panic. The panic trace indicates that the fault occurs during the runtime resume of the audio mix clock (clk_imx8mp_audiomix_runtime_resume) and related power management callbacks. The root cause is that the required BUS clock for the block control (BLK-CTL) must be enabled to properly wait for the handshake, but this clock is managed by a separate driver, making direct synchronization difficult. Consequently, the fix involves increasing the delay from 5 microseconds to 10 microseconds (udelay(10)) based on experimental data to ensure the hardware is ready before proceeding. This vulnerability affects Linux kernel versions containing the specified commit hashes and is particularly relevant to embedded systems using the Toradex Verdin iMX8M Plus WB module or similar hardware platforms. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

The vulnerability can cause kernel panics on affected devices, leading to system crashes and loss of availability. For European organizations deploying embedded Linux systems based on the i.MX8M Plus platform—commonly used in industrial automation, IoT devices, automotive infotainment, and edge computing—this can result in unexpected downtime, operational disruption, and potential safety risks if critical systems reboot unexpectedly. The kernel panic triggered by asynchronous SError interrupts affects system stability and could complicate maintenance and reliability of devices in production environments. While this vulnerability does not directly expose confidentiality or integrity risks, the availability impact is significant, especially for real-time or safety-critical applications. The lack of known exploits reduces immediate risk, but the hardware-specific nature means organizations using affected hardware must prioritize patching to prevent service interruptions.

Organizations should promptly apply the Linux kernel patch that increases the delay after the power-up handshake from 5 to 10 microseconds in the pmdomain imx gpcv2 driver. This patch is essential to prevent kernel panics related to asynchronous SError interrupts. For embedded device manufacturers and integrators, it is critical to update the kernel version in their firmware builds to include this fix. Additionally, thorough testing of power management sequences on affected hardware platforms should be conducted to ensure stability post-patch. Monitoring kernel logs for signs of asynchronous SError interrupts or runtime resume failures can help detect unpatched systems. Where possible, coordinate with hardware vendors like Toradex to obtain updated BSPs (Board Support Packages) that incorporate this fix. Avoid custom modifications that alter power management timing without thorough validation. Finally, implement robust fallback and recovery mechanisms in embedded systems to handle unexpected kernel panics gracefully, minimizing operational impact.