The wave5 media driver in the Linux kernel contains a race condition in polling mode where an hrtimer can fire after the kthread worker has begun destruction. The kernel’s kthread_destroy_worker checks that its work lists are empty and emits a WARN_ON when they are not, resulting in a warning trace every time the module is unloaded. This warning indicates that new work was queued during worker teardown, potentially causing repeated unload failures and kernel instability.

Any Linux kernel that builds and loads the wave5 media driver is affected. No specific kernel or driver versions are listed, so the issue applies to all builds that include this driver compiled in polling mode.

The EPSS score is not available and the CVE is not listed in CISA KEV, indicating no known public exploitation. No CVSS score is provided, so the exact severity is unclear, but the flaw results only in kernel warnings and potential instability rather than privilege escalation or data disclosure. An attacker would need the ability to load and unload the wave5 driver, which typically requires root or device access, and could trigger repeated warnings or a denial‑of‑service by forcing many unloads.