{"id":24554,"date":"2026-09-16T20:32:28","date_gmt":"2026-09-16T12:32:28","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89867"},"modified":"2026-09-16T20:32:28","modified_gmt":"2026-09-16T12:32:28","slug":"cve-2026-89867","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89867","title":{"rendered":"CVE-2026-89867 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: w"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued<\/p>\n<p>Decoder instances sharing a VPU also share one v4l2_m2m job slot, released<br \/>\nwhen the running context calls v4l2_m2m_job_finish(). While draining,<br \/>\ndevice_run() defers job_finish() once EOS is sent (sent_eos), expecting a<br \/>\nlater finish_decode() (from a DEC_PIC completion IRQ) to release the slot.<\/p>\n<p>But the m2m core checks job_ready() only when a job is queued, not when it<br \/>\nis dispatched. A job queued while draining can run after finish_decode()<br \/>\nhas already moved the instance to STOP and sent EOS. device_run() then runs<br \/>\nin STOP, issues no DEC_PIC, yet still skips job_finish() &#8211; so no IRQ, no<br \/>\nfinish_decode(), and the shared slot is leaked, stalling every instance.<br \/>\nWith several v4l2h264dec instances in parallel, GStreamer hangs at EOS.<\/p>\n<p>Track whether the run actually queued a DEC_PIC (cmd_issued) and defer<br \/>\njob_finish() only then. Otherwise finish the job immediately<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued<\/p>\n<p>Decoder instances sharing a VPU also share one v4l2_m<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24554","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}