Executive brief
The Linux kernel's Wave5 media decoder driver contains a resource leak that causes video decoding instances to hang when shutting down. When multiple video streams share the same VPU hardware and attempt to stop simultaneously, a shared job processing slot can become permanently blocked, freezing all active decoding operations. This prevents GStreamer and similar multimedia applications from cleanly terminating video playback.
Technical details
The vulnerability exists in the Wave5 VPU decoder's device_run() function in wave5-vpu-dec.c. Multiple decoder instances share a single v4l2_m2m job slot; when EOS (End-Of-Stream) is sent during drain operations, the code defers job_finish() expecting a DEC_PIC completion IRQ to release the slot. However, a job queued while draining can execute after the instance transitions to STOP state. In this case, device_run() runs with no DEC_PIC command to issue, yet still skips job_finish(), leaving the slot unreleased and no IRQ pending. The fix tracks whether a DEC_PIC was actually queued (via cmd_issued flag) and only defers job_finish() in that case, otherwise finishing immediately to release the shared slot. The patch was merged into stable kernels starting with commit b694ba0a5526a69f78a6924982b1553154ccfd73.
Affected products
- Linux Linux kernel Affected versions include multiple stable branches (4.x, 5.x, 6.x, 7.x); patched in commit b694ba0a5526a69f78a6924982b1553154ccfd73 and later
Timeline
- 2026-09-16: disclosed: Published to NVD
- 2026-07-17: patched: Patch merged upstream (commit b694ba0a5526a69f78a6924982b1553154ccfd73)
- 2026-09-11: patched: Patch backported to stable kernel (commit 63d758d2f9dba836d5ae597d317cde522e817cf9)