HIGH Introduced in 6.8
wave5 M2mCtx UAF
CVE-2026-97513
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2m_ctx release and wave5_release function removing stream instance from list of active instances. The IRQ thread looks for the m2m_ctx which is freed so null pointer dereference occurs.
02KernelScan AI Analysis
Risk summary
A local user with access to the wave5 VPU video codec device node can trigger a use-after-free by closing the device during active interrupt handling, potentially leading to kernel memory corruption or a system crash. The vulnerability requires specific chips-media wave5 hardware and depends on winning a narrow race window between the cleanup path and the IRQ handler thread. Any product incorporating this hardware and exposing the device node to non-root users is at risk.
Vulnerability analysis
The wave5 video codec driver frees the memory-to-memory context before removing the stream instance from the driver's list of active instances. If the hardware interrupt handler runs in this window, it finds the instance still listed and accesses the already-freed context, causing a use-after-free that typically manifests as a null pointer dereference and kernel oops. The fix moves the context release to after the instance has been removed from the active list under the proper locks, closing the race window so the interrupt handler can never observe a freed context. The vulnerable path is reachable by any local user who can open the wave5 VPU device node, requires the specific chips-media wave5 hardware to be present, and exploitation depends on winning a race between the device close path and the interrupt handler thread.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.8 | 6.18.53 | 04cda0b5c4ca |
| mainline | 6.8 | 7.2 | 7cdbd7bb2194 |