During media encoding in the Linux kernel, the wave5 driver can return a buffer to userspace before removing it from the ready queue. If userspace queues the same buffer again, a self‑loop can form in the list that tracks ready buffers. When the list is later deleted, the corrupt pointers prevent the list head from being reached, poisoning kernel data structures and potentially corrupting memory. This flaw could be leveraged to destabilize the kernel.

All Linux kernel installations that include the media subsystem driver "chips‑media wave5" are affected, regardless of distribution. The fix moves the buffer removal into finish_encode, eliminating the race. No specific kernel version is listed, so any kernel that has not applied the patch is vulnerable.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of < 1% indicates a very low probability of exploitation. Because the flaw relies on a race between IRQ handling and userspace enqueuing, the practical attack window is narrow. Although listed as a memory corruption issue, there are currently no publicly known exploits, and the vulnerability is not listed in CISA KEV.