CVE-2026-97513: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Release m2mctx after Instance Removed from List
Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of active instances. The IRQ thread looks for the m2mctx which is freed so null pointer dereference occurs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the wave5 release path, remove the stream instance from the list of active instances before releasing the m2m_ctx; ensure wave5_release releases m2m_ctx only after the instance has been removed.
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel Wave5 media driver are relevant. The issue involves an active stream instance and its associated m2m context during instance teardown.
What timing condition triggers the failure?
The IRQ thread must acquire the spinlock after the m2m context is released but before wave5_release removes the stream instance from the active-instance list. It can then find and access the freed context.
What is the resulting impact?
The race can cause a use-after-free condition and a null pointer dereference in the IRQ thread.
Where can the resolved changes be reviewed?
The provided stable-kernel references are 04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659 and 7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c.