In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible… (CVE-2026-98903)

The Linux kernel's imx mailbox driver had a race condition during channel shutdown. The RX event could remain enabled because the shutdown process disabled the RX event while the interrupt was active, but the interrupt service routine could re-enable it before free_irq() completed. This timing window could cause issues on shared interrupt handlers if the removed channel triggered an interrupt, leading to irq-core shutdown with a 'nobody cared' message. The fix introduced a shutdown flag (imx_mu_con_priv::shutdown) set with a lock to signal channel shutdown, ensuring that events are only enabled if the channel is not shutting down, thus serializing access and preventing the race.

If exploited, this race condition could cause improper interrupt handling on shared interrupt lines, potentially leading to unexpected irq-core shutdown messages and unstable interrupt behavior. However, no known exploits are reported in the wild.

A fix has been implemented in the Linux kernel by introducing a shutdown flag to properly serialize channel shutdown and interrupt event enabling. Users should update to the kernel version containing this fix once available. Patch status is not explicitly stated; check the vendor or Linux kernel advisory for the exact fixed versions and remediation guidance.