CVE-2026-89867

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued

Decoder instances sharing a VPU also share one v4l2_m2m job slot, released when the running context calls v4l2_m2m_job_finish(). While draining, device_run() defers job_finish() once EOS is sent (sent_eos), expecting a later finish_decode() (from a DEC_PIC completion IRQ) to release the slot.

But the m2m core checks job_ready() only when a job is queued, not when it is dispatched.

Leer descripción completaMostrar menos

A job queued while draining can run after finish_decode() has already moved the instance to STOP and sent EOS. device_run() then runs in STOP, issues no DEC_PIC, yet still skips job_finish() - so no IRQ, no finish_decode(), and the shared slot is leaked, stalling every instance. With several v4l2h264dec instances in parallel, GStreamer hangs at EOS.

Track whether the run actually queued a DEC_PIC (cmd_issued) and defer job_finish() only then. Otherwise finish the job immediately

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.20%
Percentil entre todas las CVEs puntuadas: 9
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-89867",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "a176ac5e701f1ba30843c0d7e0663a761bf9a61a",
              "lessThan": "63d758d2f9dba836d5ae597d317cde522e817cf9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a176ac5e701f1ba30843c0d7e0663a761bf9a61a",
              "lessThan": "b694ba0a5526a69f78a6924982b1553154ccfd73",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-16T11:16:54.843",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/63d758d2f9dba836d5ae597d317cde522e817cf9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b694ba0a5526a69f78a6924982b1553154ccfd73",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued\n\nDecoder instances sharing a VPU also share one v4l2_m2m job slot, released\nwhen the running context calls v4l2_m2m_job_finish(). While draining,\ndevice_run() defers job_finish() once EOS is sent (sent_eos), expecting a\nlater finish_decode() (from a DEC_PIC completion IRQ) to release the slot.\n\nBut the m2m core checks job_ready() only when a job is queued, not when it\nis dispatched. A job queued while draining can run after finish_decode()\nhas already moved the instance to STOP and sent EOS. device_run() then runs\nin STOP, issues no DEC_PIC, yet still skips job_finish() - so no IRQ, no\nfinish_decode(), and the shared slot is leaked, stalling every instance.\nWith several v4l2h264dec instances in parallel, GStreamer hangs at EOS.\n\nTrack whether the run actually queued a DEC_PIC (cmd_issued) and defer\njob_finish() only then. Otherwise finish the job immediately"
    }
  ],
  "lastModified": "2026-09-16T11:16:54.843",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}