Executive brief
A flaw was identified in the Linux kernel's Wave5 video processing unit driver when operating in polling mode. This issue occurs during the removal of the software module, where a race condition can trigger system warnings and potential instability. While primarily a stability concern, it affects systems using specific Chips&Media video hardware.
Technical details
A race condition exists in the wave5_vpu_remove function of the Chips&Media Wave5 VPU driver. When the driver operates in polling mode (irq < 0), it utilizes an hrtimer to queue work to a kthread worker. The original cleanup sequence called kthread_destroy_worker() before hrtimer_cancel(), allowing the timer to potentially fire and queue new work while the worker was being destroyed. This triggers WARN_ON assertions in the kernel's kthread implementation because the work lists are not empty during destruction. The fix reorders the cleanup to cancel the timer and synchronize pending work before destroying the worker.
Affected products
- Linux Linux Kernel Versions including wave5 driver with polling support
Timeline
- 2025-12-04: other: Patch authored by Xulin Sun
- 2026-05-08: disclosed: CVE published