Executive brief
A vulnerability was identified in the Linux kernel's Wave5 video codec driver, which is used for hardware-accelerated video processing. The issue occurs when the driver is unloaded, potentially causing a system instability or a kernel warning due to incorrect power management tracking. While primarily a stability issue, it could impact the reliability of systems performing heavy video encoding or decoding tasks.
Technical details
A runtime PM usage count underflow exists in the chips-media Wave5 VPU driver (wave5-vpu.c). The driver's remove path incorrectly called pm_runtime_put_sync() unconditionally, even if the device was already suspended via autosuspend. This caused the reference count to drop to -1, triggering a kernel warning (underflow) during module unload. The fix replaces the incorrect call with pm_runtime_dont_use_autosuspend() to properly pair with the probe configuration. This is a local stability issue reachable during driver removal/module unloading.
Affected products
- Linux Linux Kernel Versions including Wave5 VPU driver
Timeline
- 2025-12-04: other: Patch authored
- 2026-05-08: disclosed: CVE published