CVE-2026-89867

CVE-2026-89867 affects the Linux kernel chips-media wave5 VPU driver in the media subsystem. Decoder instances sharing a VPU also share a single v4l2_m2m job slot . During end-of-stream (EOS), device_run() defers job_finish() expecting a DEC_PIC completion IRQ to release the slot. However, a job ...

EUVD-2026-80467

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Defer jobfinish only when a DECPIC was queued Decoder instances sharing a VPU also share one v4l2m2m job slot, released when the running context calls v4l2m2mjobfinish. While draining, devicerun defers...