SB2026050748 - NULL pointer dereference in Linux kernel chips-media wave5 driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-43263)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the wave5 decoder IRQ handler when handling concurrent decoder instance creation and destruction. A local user can trigger repeated multi-instance operations to cause a denial of service.

The issue occurs because the shared struct vpu_instance may be accessed after decoder structures are removed during interrupt handling.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/d12bcf183ec7da4305d848068d15f18044eaf62a
• https://git.kernel.org/stable/c/e66ff2b08e4ee1c4d3b84f24818e5bcc178cc3a4
• https://git.kernel.org/stable/c/ea316b784fe6a61b29131c98cddb24e651b1dcbc