The Linux kernel’s imx mailbox driver contains a race between channel shutdown and the interrupt service routine, allowing an interrupt event to remain enabled after the channel is removed. This flaw can cause unexpected interrupt handling and potentially lead to a kernel crash or denial of service. The vulnerability is a concurrency fault and does not directly enable code execution.

This flaw exists in any Linux kernel build that includes the imx mailbox subsystem, typically used on i.MX System-on-Chip platforms. Because specific affected kernel versions are not listed, any build of the kernel before the upstream fix that employs the vulnerable mailbox driver may be impacted.

The race condition requires precise timing and access to the same interrupt handler, making it difficult to trigger from user space. No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating moderate or lower exploitation likelihood. While it does not provide remote code execution, an attacker could use the flaw to destabilize the system. Applying the official patch that introduces the shutdown flag removes the race and prevents the problematic interrupt behavior.