CVE-2026-89866

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the wave5 media driver where the system fails to resume the device before setting the End of Stream (EOS) flag. The process of setting the EOS flag involves communicating with the firmware through the send firmware command() function, which requires access to Video Processing Unit (VPU) registers. Because the wave5 vpu dec job abort() function (used in the STREAMOFF path) and the wave5 vpu dec stop() function (used in the V4L2 DEC CMD STOP path) can execute while the device is in a runtime suspended state, the resulting register accesses target powered-down hardware. This causes the System on Chip (SoC) to trigger an asynchronous SError, leading to a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.