CVE-2026-97513media: chips-media: wave5: Release m2m_ctx after Instance Removed from List
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2m_ctx release and wave5_release function removing stream instance from list of active instances. The IRQ thread looks for the m2m_ctx which is freed so null pointer dereference occurs.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 9707a6254a8a6b978bde811a44fe07d86c229d1c builds before 04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659; 9707a6254a8a6b978bde811a44fe07d86c229d1c builds before 7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c | CNA record |
References
- https://git.kernel.org/stable/c/04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659
- https://git.kernel.org/stable/c/7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.