wave5 M2mCtx UAF

Vulnerability analysis

The wave5 video codec driver frees the memory-to-memory context before removing the stream instance from the driver's list of active instances. If the hardware interrupt handler runs in this window, it finds the instance still listed and accesses the already-freed context, causing a use-after-free that typically manifests as a null pointer dereference and kernel oops. The fix moves the context release to after the instance has been removed from the active list under the proper locks, closing the race window so the interrupt handler can never observe a freed context. The vulnerable path is reachable by any local user who can open the wave5 VPU device node, requires the specific chips-media wave5 hardware to be present, and exploitation depends on winning a race between the device close path and the interrupt handler thread.