The vulnerability occurs when the mailbox driver for i.MX processors calls devm_pm_runtime_enable() before the probe has fully completed. This premature power‑management enable can lead to the device being accessed prematurely, potentially causing incorrect power state handling or the device being torn down in an improper order. The flaw can result in kernel instability or a denial of service if the driver attempts to use an uninitialized hardware controller.

All Linux kernel builds that include the mailbox driver for i.MX processors, as the issue resides in the kernel source itself. The specific kernel version range is not disclosed; therefore any kernel containing the unpatched mailbox implementation may be affected.

The CVSS score of 4.1 denotes moderate severity, and the EPSS score of less than 1% along with not being listed in the CISA KEV catalog indicate a low likelihood of exploitation. The CVE data does not describe an explicit attack surface or method to trigger the flaw, and no public exploitation has been reported. The primary impact remains potential kernel instability or denial of service if the driver is exercised during an incomplete probe.