Linux Kernel EUVD-2026-28571

The vulnerability requires the following specific conditions: (1) the wave5 video codec driver must be compiled into the kernel or loaded as a module, (2) the driver must reach the autosuspend timeout period without active video decoding or encoding, allowing the device to enter suspended state with a zero usage count, and (3) the user must initiate driver removal via module unload (rmmod/modprobe -r) or system shutdown while the device remains in the autosuspended state. The vulnerability does NOT occur if the device is actively in use (non-zero usage count) at removal time, as autosuspend will not trigger during active operations. Authentication is required at the local system level, as the attacker must be a local user with permission to execute modprobe commands, but no elevated privileges beyond standard user permissions are necessary (PR:L per CVSS vector). The condition is NOT triggered on systems where the wave5 driver is not enabled or where the device is never used, limiting real-world impact to deployments that actively employ this specific video codec hardware.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms local, unprivileged access with low complexity is required, and the impact is limited to availability (denial of service via kernel warning and potential system instability). The extremely low EPSS score of 0.02% (4th percentile) indicates minimal real-world exploitation probability despite the moderate CVSS score of 5.5, suggesting this is primarily a kernel stability and module unload reliability issue rather than a practical attack vector. The vulnerability requires the attacker to be a local user with basic privileges and relies on timing of autosuspend (a normal driver operation), making it a low-priority exploitation target but a valid stability concern for production systems where the wave5 driver is deployed. The denial-of-service impact is limited to system warnings and potential module unload failures rather than kernel panic or complete system compromise. Risk is further reduced by the fact that exploitation requires the specific wave5 driver to be in use and for module unload to occur during the vulnerable window.

A local unprivileged user with basic shell access triggers the vulnerability by removing the wave5 codec driver module after it has been idle long enough for autosuspend to activate and suspend the device. When rmmod or modprobe -r executes, the driver's remove function calls pm_runtime_put_sync() on an already-suspended device with a zero usage count, decrementing it to -1 and triggering a kernel warning. On systems with CONFIG_DEBUG_KTHREAD or similar kernel debugging enabled, this causes visible kernel warnings and may prevent clean module unload, forcing the system administrator to reboot or reload the module manually.