CVE-2026-89867

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the wave5 media driver where decoder instances sharing a VPU also share a single v4l2 m2m job slot. During the draining process, the device run() function defers the v4l2 m2m job finish() call after an End of Stream (EOS) is sent, expecting a subsequent finish decode() call triggered by a DEC PIC completion interrupt request (IRQ) to release the slot. However, because the m2m core only checks job ready() during queuing rather than dispatching, a job queued during draining may execute after the instance has transitioned to a STOP state. In this scenario, device run() executes in STOP and does not issue a DEC PIC, yet it still skips job finish(). This results in a leaked shared slot and a lack of IRQ, causing all instances to stall and leading to GStreamer hangs at EOS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.