CVE-2026-89868: media: chips-media: wave5: Add timeout while stop_streaming
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Add timeout while stopstreaming
When stopstreaming is called, an infinite loop may occur in some cases. Add a bounded poll of the queue status: loop until the queues drain, sleeping briefly between polls, and bail out once VPUDECSTOPTIMEOUT elapses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the wave5 driver stop_streaming path to poll queue status with a bounded loop: loop until the queues drain, sleeping briefly between polls, and bail out once VPU_DEC_STOP_TIMEOUT elapses to prevent an infinite loop.
Linux kernel media: chips-media: wave5 Add timeout while stop_streaming (queue drain polling bound) = VPU_DEC_STOP_TIMEOUT
Event History
Frequently Asked Questions
Which systems are affected by this issue?
Systems running the Linux kernel with the chips-media Wave5 media driver are relevant. The problem occurs during the driver's stop_streaming operation.
What is the practical impact if the issue is triggered?
Stopping a stream can enter an infinite loop when queue draining does not complete. This can cause the stop_streaming operation to hang indefinitely.
What does the fix change?
The fix replaces the unbounded wait with polling that sleeps briefly between queue-status checks and stops waiting after VPU_DEC_STOP_TIMEOUT expires. The referenced stable kernel commits contain the resolution.