Executive brief
The Linux kernel's Wave5 video decoder driver can panic when receiving stream termination commands while the hardware is suspended. Systems performing video decoding may crash unexpectedly during normal operation when power management causes the decoder hardware to suspend, particularly during video playback teardown or stream shutdown.
Technical details
A race condition exists in the Wave5 video decoder driver (drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c) where firmware command functions attempt to access VPU registers without ensuring the device is powered on. When V4L2_DEC_CMD_STOP or STREAMOFF operations occur while the device is runtime suspended, register accesses hit powered-down hardware, triggering an asynchronous SError that panics the kernel. The vulnerability affects two code paths: wave5_vpu_dec_stop() and wave5_vpu_dec_job_abort(). The fix wraps the EOS flag operations with pm_runtime_resume_and_get() and pm_runtime_put_autosuspend() to ensure proper power state management. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel 5.x, 6.x, 7.x (before 2026-06-26)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-06-26: patched: Original upstream commit a52e6f7923c17a672135b485ffd96fbd72f46267
- 2026-09-11: other: Backported to stable trees