In the Linux kernel’s media driver, the removal path mistakenly called pm_runtime_put_sync() without accounting for autosuspend. When the device had already entered suspend, the runtime usage count was zero and the call decremented it to –1, producing a warning on module unload. This mis‑management of the usage counter does not lead to a crash, data corruption, or privilege escalation; it only triggers a kernel warning. The impact is limited to a console log entry and does not compromise confidentiality, integrity, or availability.

The flaw exists in the Linux kernel’s chips‑media wave5 driver. All kernel releases that include this driver prior to the commit fixing the underflow may be affected. Linux distributions that have not yet upgraded to a kernel containing the patch could experience the warning when the driver is unloaded.

Based on the description, it is inferred that the likely attack vector is a local attacker who can load or unload kernel modules, typically requiring privileged access. The CVSS base score is 5.5, reflecting a moderate level of risk, while the EPSS score is < 1%, indicating a low likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. The issue manifests as a warning on module unload when a device that has automatic suspend already engaged is removed; it does not lead to a crash, data corruption, or privilege escalation. Although the flaw can be triggered by a privileged user, there is no remote or privilege‑escalation vector, so exploitation is currently unlikely to be a serious threat.