CVE-2026-97514

Received Received - Intake

Race Condition in Linux Kernel Video4Linux2 Driver

Publication date: 2026-09-24

Last updated on: 2026-09-28

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix Reports from Kernel Lock Validator handle_dynamic_resolution change requires that the state_lock be acquired based on the lockdep_assert_held. However, the handle_dynamic_resolution_change call in initialize_sequence does not properly obtain the lock before calling. Since the v4l2_ctrl_find and s_ctrl can sleep, they should not be called while a lock is already held. Store off the fbc_buf_count then properly update control once lock has been freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-28

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97514

EUVD

EUVD-2026-86112

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of locks in the media subsystem. Specifically, the handle_dynamic_resolution_change function in the chips-media wave5 driver fails to acquire the state_lock before calling functions that can sleep (v4l2_ctrl_find and s_ctrl). This violates lockdep_assert_held and may lead to deadlocks or race conditions.

Detection Guidance

This vulnerability is specific to the Linux kernel's media subsystem and requires kernel-level inspection. Detection involves checking for kernel lock issues in the chips-media wave5 driver. No direct network detection commands are applicable. Review kernel logs for lockdep warnings or kernel crashes related to media drivers.

Impact Analysis

This vulnerability could cause system instability, crashes, or unpredictable behavior in systems using the affected Linux kernel media subsystem. It may lead to kernel deadlocks or corruption if exploited, potentially disrupting media processing tasks.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel locking issue without implications for data protection or privacy controls.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel patches from your distribution vendor and apply them promptly.

Hi! I’m here to help you understand CVE-2026-97514. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70