Description

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2m_ctx release and wave5_release function removing stream instance from list of active instances. The IRQ thread looks for the m2m_ctx which is freed so null pointer dereference occurs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:29.210Z",
  "pubdate": "2026-09-24T17:17:29.210Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's chips-media wave5 driver, specifically concerning the m2m_ctx object lifecycle. The flaw arises from a race condition between the instance release process and an active IRQ thread.\nThe vulnerability allows an attacker to trigger a null pointer dereference or potential memory corruption if the IRQ thread attempts to access a freed m2m_ctx structure while the driver is performing instance removal.\nThe impact is significant, potentially leading to system instability, kernel panic, or localized denial-of-service. Successful exploitation typically requires an attacker to interact with the device driver via user-space ioctl calls to initiate concurrent release and interrupt handling sequences.\nThis vulnerability highlights a flaw in synchronization logic within the media subsystem, specifically where resource cleanup sequences are not atomically decoupled from interrupt service routine (ISR) execution paths.",
  "technicalDetails": "The vulnerability is rooted in an improper ordering of object teardown within the wave5_release function. In the Linux kernel's media subsystem, the m2m_ctx (memory-to-memory context) must be managed with strict lifecycle synchronization to prevent concurrent access after deallocation.\nThe race condition occurs because the m2m_ctx structure is released before the stream instance is officially removed from the list of active instances managed by the driver. During this window of time, the hardware or the driver's IRQ thread may still be active.\nWhen an interrupt occurs, the IRQ thread iterates through the active stream instances to identify the relevant m2m_ctx associated with the event. If the IRQ thread manages to acquire the relevant spinlock between the call to free the m2m_ctx and the subsequent removal of the instance from the tracking list, it will retrieve a stale or dangling pointer.\nUpon accessing this pointer, the IRQ thread attempts to perform operations on the invalidated memory, resulting in a null pointer dereference or, in more complex scenarios, arbitrary memory access if the memory has been reallocated by the kernel slab allocator for other purposes (Use-After-Free).\nThe attack flow follows these steps: 1) The user-space process initiates the closure of a media instance, leading the kernel to execute wave5_release. 2) The driver releases the m2m_ctx pointer. 3) An asynchronous hardware interrupt triggers the execution of the driver's IRQ thread. 4) The IRQ thread executes while the object is in a partially destroyed state but still present in the instance list. 5) The IRQ thread attempts to dereference the freed m2m_ctx, leading to a kernel crash.\nThis vulnerability is localized to the wave5 driver and depends on the kernel's scheduling of high-priority IRQ threads against standard process-context teardown routines. No specific network exposure is required; local access to the device node is sufficient for an unprivileged user to initiate the vulnerable cleanup path."
}