UBUNTU-CVE-2026-97514: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix Reports from Kernel Lock Validator handledynamicresolution change requires that the statelock be acquired based on the lockdepassertheld. However, the handledynamicresolutionchange call in initializesequence does not properly obtain the lock before calling. Since the v4l2ctrlfind and sctrl can sleep, they should not be called while a lock is already held. Store off the fbcbufcount then properly update control once lock has been freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems running one of the listed Ubuntu kernel packages are in scope: linux, linux-fips, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants. The affected code is in the Linux kernel media chips-media wave5 component.
What level of access does an attacker need?
The supplied CVSS vector indicates local access and high privileges are required. No user interaction is required.
What is the primary impact indicated by the severity vector?
The vector indicates high impact to availability, with no indicated impact to confidentiality or integrity. The issue concerns locking around dynamic-resolution handling and control updates that may sleep.