diff --git a/drivers/platform/tegra/nvadsp/mailbox.c b/drivers/platform/tegra/nvadsp/mailbox.c
index 753265a7..3b197a6e 100644
--- a/drivers/platform/tegra/nvadsp/mailbox.c
+++ b/drivers/platform/tegra/nvadsp/mailbox.c
@@ -14,6 +14,7 @@
  */
 
 #include "dev.h"
+#include <linux/nospec.h>
 #include <asm/barrier.h>
 
 #define NVADSP_MAILBOX_START	512
@@ -187,7 +188,9 @@ status_t nvadsp_mbox_open(struct nvadsp_mbox *mbox, uint16_t *mid,
 			ret = -ERANGE;
 			goto out;
 		}
-		speculation_barrier();
+
+		*mid = array_index_nospec(*mid, NVADSP_MAILBOX_MAX);
+
 		if (nvadsp_drv_data->mboxes[*mid]) {
 			pr_debug("%s: mailbox %d already opened.\n",
 				 __func__, *mid);