CVE-2026-97513 (GCVE-0-2026-97513)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:05 – Updated: 2026-09-25 05:10
VLAI
Title
media: chips-media: wave5: Release m2m_ctx after Instance Removed from List
Summary
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2m_ctx release and wave5_release function removing stream instance from list of active instances. The IRQ thread looks for the m2m_ctx which is freed so null pointer dereference occurs.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c (git)
Affected: 0 , < 6.18.53 (semver)
guessed Create a notification for this product.
Linux Linux Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/chips-media/wave5/wave5-helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/chips-media/wave5/wave5-helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Release m2m_ctx after Instance Removed from List\n\nPossible use after free if IRQ thread manages to obtain spinlock between\nm2m_ctx release and wave5_release function removing stream instance from\nlist of active instances. The IRQ thread looks for the m2m_ctx which is\nfreed so null pointer dereference occurs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in wave5_vpu_release_device(), reached only by close() on the Wave5 V4L2 mem2mem node (/dev/videoN): v4l2_release -\u003e wave5_vpu_dec_release/wave5_vpu_enc_release. No network, Bluetooth, or USB packet supplies the triggering state.\nAC:L - The attacker queues decode/encode work so the VPU raises INT_WAVE5_DEC_PIC/ENC_PIC into inst-\u003eirq_status, then close()s so v4l2_m2m_ctx_release() kfree\u0027s m2m_ctx while the instance is still on dev-\u003einstances. Both sides of the race (STREAMON/QBUF vs close) are attacker-controlled and retryable.\nPR:L - v4l2_open, wave5_vpu_open_dec(), and wave5_vpu_open_enc() perform no capable() checks; access is only the video node. On TI K3 systems that ship this driver, that node is available to unprivileged video-group or media-client users, not init-namespace root.\nUI:N - The attacker opens the Wave5 decoder or encoder themselves, STREAMONs, and close()s that fd to enter wave5_vpu_release_device(). No separate victim action such as mounting a filesystem is required.\nS:U - The UAF of inst-\u003ev4l2_fh.m2m_ctx is in the host Wave5 media driver and affects the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - After v4l2_m2m_ctx_release() kfree\u0027s m2m_ctx, wave5_vpu_irq_thread() still finds the instance on dev-\u003einstances and wave5_vpu_dec_finish_decode()/wave5_vpu_enc_finish_encode() read the freed object (v4l2_m2m_get_dst_vq and related helpers), a slab UAF that enables arbitrary read.\nI:H - The same finish_process path writes through the freed m2m_ctx via v4l2_m2m_job_finish(), v4l2_m2m_dst_buf_remove_by_idx()/v4l2_m2m_src_buf_remove_by_idx(), and v4l2_m2m_buf_done(), so reclaiming the kzalloc\u0027d context yields a kernel write/control-flow primitive.\nA:H - Use of the dangling m2m_ctx in wave5_vpu_dec_finish_decode()/wave5_vpu_enc_finish_encode() oopses the kernel (the commit documents a NULL deref of the freed context) even when the UAF is not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:10:56.156Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c"
        }
      ],
      "title": "media: chips-media: wave5: Release m2m_ctx after Instance Removed from List",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97513",
    "datePublished": "2026-09-24T16:05:10.589Z",
    "dateReserved": "2026-09-24T16:01:01.151Z",
    "dateUpdated": "2026-09-25T05:10:56.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97513",
      "date": "2026-09-25",
      "epss": "0.00115",
      "percentile": "0.01363"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/chips-media/wave5/wave5-helper.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.18.53",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/chips-media/wave5/wave5-helper.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Release m2m_ctx after Instance Removed from List\n\nPossible use after free if IRQ thread manages to obtain spinlock between\nm2m_ctx release and wave5_release function removing stream instance from\nlist of active instances. The IRQ thread looks for the m2m_ctx which is\nfreed so null pointer dereference occurs."
          }
        ],
        "id": "CVE-2026-97513",
        "lastModified": "2026-09-25T05:17:07.540",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:29.210",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-25T23:47:00Z",
      "cve": "CVE-2026-97513",
      "id": "CVE-2026-97513",
      "initial_release_date": "2026-09-24T23:44:54Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-97513",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-97513.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.