Linux Kernel EUVD-2026-27660

Requires local authenticated user access to a Linux system with the chips-media wave5 kernel driver loaded and active wave5 video codec hardware present. Vulnerable configurations are primarily embedded devices, set-top boxes, or specialized media appliances using SoCs with Chips&Media WAVE5 IP cores. Exploitation trigger requires ability to create multiple concurrent video decoder instances via /dev/video* device nodes (typically accessible to users in 'video' group or with appropriate udev permissions) and rapidly cycle them through initialization/teardown to hit the race window. Generic x86/ARM server or desktop systems without wave5 hardware will not load the driver module and are not exposed. Default kernel configurations on most distributions compile wave5 as module (CONFIG_VIDEO_WAVE_VPU=m), limiting exposure to systems actively using the hardware. Local user interaction required to open video device nodes and trigger decoder operations, but no UI prompts needed once access obtained (UI:N in CVSS).

Despite the CVSS 7.8 HIGH rating, real-world risk appears limited. The CVSS vector (AV:L/AC:L/PR:L/UI:N) correctly identifies this as requiring local authenticated access with low complexity, but the attack surface is constrained to systems actively using wave5 hardware video decoding with the specific driver loaded. The EPSS score of 0.02% (4th percentile) suggests security researchers and attackers have not prioritized this vulnerability, likely because exploitation requires both local access and specific hardware/driver configuration. No CISA KEV listing exists, confirming no observed active exploitation. The NULL pointer dereference in kernel space typically results in kernel panic/system crash (availability impact) rather than reliable code execution, though the CVSS claims high confidentiality and integrity impact which seems potentially overstated without additional context about exploitability. Priority should be moderate for systems using wave5-equipped SoCs (certain embedded media devices, set-top boxes) with local user access, but low for general-purpose Linux servers or desktops unlikely to load this specialized driver. The primary risk vector is denial-of-service rather than privilege escalation, though kernel memory corruption bugs warrant careful assessment.

A local authenticated user on an embedded device with wave5 video hardware repeatedly creates and destroys multiple video decoder instances concurrently (simulating multi-stream decode workload or running conformance test suites like Fluster). During the overlapping instance lifecycle operations, an interrupt fires for a decoder instance while its vpu_instance structure is being freed or reinitialized in another thread. The unsynchronized access in the IRQ handler dereferences the NULL or invalid pointer, triggering a kernel oops and system crash. While typically resulting in denial-of-service, skilled attackers might attempt to leverage the memory corruption window for privilege escalation by timing heap manipulations, though no public POC demonstrates this.