The Linux media driver for chips‑media wave5 contains a race condition that can cause a null pointer dereference when multiple instances are created and destroyed concurrently. Because the shared vpu_instance structure is accessed without proper locking, an interrupt handler may return a dereferenced pointer, resulting in a kernel panic. The weakness is a NULL pointer dereference under concurrent access (CWE‑476).

This flaw affects the Linux kernel's media subsystem in the chips‑media wave5 driver. Any kernel version that includes this driver without the added lock protection is vulnerable. The specific version ranges are not listed, so all kernels shipping the unpatched driver are potentially impacted.

The CVSS score is 7.8, indicating high severity. The EPSS score is < 1%, suggesting a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed public exploitation. Because the flaw requires interaction with the media interface and the ability to spawn multiple decoder instances, it is most likely exploitable only by a local user with access to the driver. The resulting kernel crash would cause a denial of service to the affected system. There is no evidence in the description that this flaw can be leveraged for privilege escalation or remote exploitation.