In the Linux kernel’s media driver, the removal path erroneously called pm_runtime_put_sync() without accounting for autosuspend. When the device had already entered suspend, the runtime usage count was zero and the call decremented it to –1, producing a warning on module unload. This mis‑management of the usage counter does not lead to a crash, data corruption, or privilege escalation; it only triggers a kernel warning. The impact is limited to a console log entry and does not compromise confidentiality, integrity, or availability.

The flaw exists in the Linux kernel’s chips‑media wave5 driver. All kernel releases that include this driver prior to the commit fixing the underflow may be affected. Linux distributions that have not yet upgraded to a kernel containing the patch could experience the warning when the driver is unloaded.

No CVSS or EPSS score is provided, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw merely generates a warning and requires no special privilege or remote access to trigger, the risk is low. The likely attack vector is a local attacker or administrator who can load or unload kernel modules, a privilege that is already required for modifying system code. Active exploitation is improbable and the vulnerability is unlikely to be used in attacks.