The wave5 media driver in the Linux kernel contains a race condition in polling mode where an hrtimer can fire after the kthread worker has begun destruction. The kernel’s kthread_destroy_worker checks that its work lists are empty and emits a WARN_ON when they are not, resulting in a warning trace every time the module is unloaded. This warning indicates that new work was queued during worker teardown, potentially causing repeated unload failures and kernel instability.

Any Linux kernel that builds and loads the wave5 media driver is affected. No specific kernel or driver versions are listed, so the issue applies to all builds that include this driver compiled in polling mode.

The EPSS score is < 1%, indicating a very low probability of exploitation. The CVSS score of 5.5 classifies the vulnerability as moderate, but it does not enable privilege escalation or data disclosure. The flaw only triggers kernel warnings and could lead to instability when repeatedly loading and unloading the wave5 driver, typically requiring root or device access. Because it is not listed in CISA KEV, there are no known leveraged attacks.