LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23116: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu For i.MX8MQ platform, the ADB in the VPUMIX domain has no separate reset and clock enable bits, but is ungated and reset together with the VPUs. So we can't reset G1 or G2 separately, it may led to the system hang. Remove rst_mask and clk_mask of imx8mq_vpu_blk_ctl_domain_data. Let imx8mq_vpu_power_notifier() do really vpu reset.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the i.MX8MQ VPU power domain handling. The kernel could try to reset VPU components separately even though the platform resets and clocks them together, which may hang the system. The main business risk is device availability, especially for embedded products using this SoC.

Executive priority

Prioritize for embedded or edge products using i.MX8MQ, especially where reboot or device hang has operational impact. For environments without this SoC, urgency is low based on the supplied evidence.

Technical view

The affected logic is in the i.MX8M block control power-domain driver. For i.MX8MQ VPUMIX, the ADB lacks separate reset and clock-enable bits, so separate G1 or G2 reset handling can cause a system hang. Kernel stable commits remove the separate masks and rely on the VPU power notifier for reset handling.

Likely exposure

Exposure appears limited to Linux systems using the NXP i.MX8MQ platform and its VPU power-domain path. The source bundle does not support treating this as a broad Linux server or desktop exposure.

Exploitation context

The bundle reports no KEV listing and provides no evidence of active exploitation. The issue appears tied to platform power/reset behavior that can cause hangs, not a documented remote attack path.

Researcher notes

Evidence is narrow: no CVSS, CWE, exploit details, or KEV status. The CVE text identifies an availability failure caused by incorrect reset/clock assumptions in i.MX8MQ VPUMIX handling. Validate exposure through hardware, kernel source, and vendor backport status.

Mitigation direction

  • Identify products running Linux on i.MX8MQ hardware.
  • Check the kernel or BSP for the referenced stable fixes.
  • Update to a vendor-supported kernel containing the fix.
  • Monitor Linux, distribution, and board-vendor advisories for backports.

Validation and detection

  • Inventory kernel versions and hardware platform identifiers.
  • Confirm whether the i.MX8M block control VPU code is present.
  • Verify the deployed kernel includes one referenced stable commit or vendor backport.
  • Review device logs for VPU power/reset related hangs.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23116 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux608d7c325e855cb4a853afef3cd9f0df594bd12d, 608d7c325e855cb4a853afef3cd9f0df594bd12d, 608d7c325e855cb4a853afef3cd9f0df594bd12d, 608d7c325e855cb4a853afef3cd9f0df594bd12d, 608d7c325e855cb4a853afef3cd9f0df594bd12dunaffected
LinuxLinux5.18, 0, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.