CVE-2026-23116: Linux Kernel i.MX8MQ VPU DoS Vulnerability

CVE-2026-23116 Overview

A vulnerability has been resolved in the Linux kernel's power domain controller for the i.MX8MQ platform. The issue exists in the pmdomain: imx8m-blk-ctrl subsystem where incorrect handling of reset and clock mask configurations for the 8MQ VPU can lead to system instability. On the i.MX8MQ platform, the ADB (Asynchronous Debug Bridge) in the VPUMIX domain lacks separate reset and clock enable bits, meaning the VPU components are ungated and reset together. Attempting to reset the G1 or G2 video processing units separately can cause the system to hang.

Critical Impact
Improper reset handling in the i.MX8MQ VPU power domain can lead to system hangs and denial of service conditions on affected embedded Linux systems.

Affected Products

Linux kernel with i.MX8MQ VPU support
Systems using imx8m-blk-ctrl power domain driver
NXP i.MX8MQ-based embedded platforms

Discovery Timeline

2026-02-14 - CVE CVE-2026-23116 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23116

Vulnerability Analysis

This vulnerability is classified as a kernel vulnerability affecting the power management domain controller on NXP i.MX8MQ platforms. The root issue stems from architectural differences in the VPUMIX domain's reset and clock gating mechanism compared to other platforms in the i.MX8M family.

The imx8mq_vpu_blk_ctl_domain_data structure incorrectly defined separate rst_mask and clk_mask values for the VPU domain. However, the hardware architecture does not support independent control of these signals—the G1 and G2 video processing units share reset and clock enable paths through the Asynchronous Debug Bridge (ADB). When software attempts to perform a separate reset operation on either the G1 or G2 decoder, the inconsistent state between the driver's expectations and hardware behavior results in a system hang.

Root Cause

The vulnerability arises from a mismatch between the driver's software abstraction and the actual hardware implementation. The driver assumed independent reset and clock control was possible for individual VPU components, when in reality the i.MX8MQ silicon implements these as coupled operations. The fix removes the separate rst_mask and clk_mask definitions from imx8mq_vpu_blk_ctl_domain_data, delegating proper VPU reset handling to the imx8mq_vpu_power_notifier() function which correctly manages the unified reset sequence.

Attack Vector

This is primarily a stability vulnerability rather than a remotely exploitable security flaw. The attack vector would require local access to trigger VPU power domain state transitions. In scenarios where an unprivileged user or application can initiate video decoding operations that trigger power domain transitions, the vulnerability could be exploited to cause a denial of service condition. The impact is most significant in embedded systems where hardware video decoding is commonly used.

The vulnerability manifests when the kernel attempts to reset individual VPU components independently. The power management subsystem's call path through imx8mq_vpu_blk_ctl triggers the erroneous reset sequence, leaving the hardware in an inconsistent state that results in a system hang. For detailed technical information, refer to the kernel commit 3de4996.

Detection Methods for CVE-2026-23116

Indicators of Compromise

System hangs or freezes occurring during video playback or transcoding operations on i.MX8MQ platforms
Kernel panic or soft lockup messages referencing imx8m-blk-ctrl or VPU power domain operations
Inability to recover from VPU-related operations without a hard reboot

Detection Strategies

Monitor kernel logs for messages related to pmdomain, imx8m-blk-ctrl, or vpumix power domain errors
Implement watchdog monitoring for system hangs during media processing workloads
Review system boot logs and dmesg output for power domain initialization warnings

Monitoring Recommendations

Enable kernel debug logging for power management subsystems on affected embedded platforms
Deploy hardware watchdog timers to detect and recover from system hang conditions
Monitor for unexplained system reboots or freezes correlating with video processing activity

How to Mitigate CVE-2026-23116

Immediate Actions Required

Update to a patched Linux kernel version containing the fix commits
Review affected i.MX8MQ deployments and prioritize kernel updates for systems performing video processing
Consider temporarily disabling hardware video decoding on critical systems until patches can be applied

Patch Information

The vulnerability has been addressed through multiple kernel commits. The fix removes the separate rst_mask and clk_mask from imx8mq_vpu_blk_ctl_domain_data and ensures proper reset handling through imx8mq_vpu_power_notifier(). Patches are available through the following kernel git commits:

Workarounds

Avoid triggering VPU power domain state transitions on unpatched systems where possible
Disable the G1 or G2 hardware video decoders and use software decoding as a temporary measure
Implement external monitoring and automatic reboot mechanisms to recover from potential system hangs

bash

# Check current kernel version for affected systems
uname -r

# Verify if imx8m-blk-ctrl module is loaded
lsmod | grep imx8m

# Monitor power domain state (requires debugfs)
cat /sys/kernel/debug/pm_genpd/pm_genpd_summary