A use‑after‑free bug was identified in the Linux kernel’s media driver. If the IRQ thread acquires a spin between the release of an m2m_context and the removal of a stream instance from the active list, it will look up a context that has already been freed. This results in a null pointer dereference and a kernel crash. The faulty code paths are confined to the wave5 driver in the chips‑media subsystem.

All Linux kernel systems that load the media wave5 driver are impacted. Specific kernel versions are not listed in the advisory, so the vulnerability may exist in any kernel release that has not applied the patch in the kernel changelog.

The EPSS score is 0.00115, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalogue, indicating no widespread exploitation has been reported. However, the race condition needed for the exploit exists only when IRQ processing occurs between the context release and instance removal, making it a difficult local attack. If successfully triggered, the bug will crash the kernel, resulting in a local denial‑of‑service condition for the user initiating the IRQ race. The CVSS score of 7.8 classifies the vulnerability as high severity.