Executive brief
The Linux kernel's wave5 video decoder driver can hang indefinitely when stopping video playback in certain conditions. This occurs in the media subsystem's streaming control logic and could cause applications or the system to become unresponsive when terminating video decode operations.
Technical details
An infinite loop was present in the wave5_vpu_dec_stop_streaming() function that lacked a timeout mechanism. The function polled queue status until queues drained but had no bounded exit condition, allowing it to loop indefinitely if queue status never reached the required state. The fix adds a timeout-based exit condition using a jiffies-based timer (VPU_DEC_STOP_TIMEOUT increased from 10ms to 300ms) and introduces brief sleeps between polling iterations to prevent busy-waiting. This is a denial-of-service fix affecting kernel drivers used to decode video streams on systems with wave5 VPU hardware.
Affected products
- Linux Linux kernel 5.0 and later (media: chips-media: wave5 driver)
Timeline
- 2026-09-16: disclosed: CVE-2026-89868 published on NVD
- 2026-06-26: patched: Fix committed upstream (commit 2ae7faed2e60d6d07d9efdd962d20dcb15330ced)
- 2026-09-11: patched: Fix backported to stable kernel trees