{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  media: chips-media: wave5: Resume device before setting EOS flag  Setting the EOS flag talks to the firmware via send_firmware_command(), which accesses VPU registers. Both the STREAMOFF path (wave5_vpu_dec_job_abort()) and the V4L2_DEC_CMD_STOP path (wave5_vpu_dec_stop()) can run while the device is runtime suspended, so those register accesses hit powered-down hardware and the SoC raises an asynchronous SError, panicking the kernel:    SError Interrupt on CPU3, code 0x00000000bf000000 -- SError    send_firmware_command+0x2c/0x160 [wave5]    wave5_vpu_dec_set_bitstream_flag+0x6c/0x80 [wave5]    wave5_vpu_dec_update_bitstream_buffer+0x80/0xec [wave5]    wave5_vpu_dec_job_abort+0x44/0xa0 [wave5]    v4l2_m2m_cancel_job+0x110/0x19c [v4l2_mem2mem]    v4l2_m2m_streamoff+0x24/0x140 [v4l2_mem2mem]  Resume the device with pm_runtime_resume_and_get() around the EOS firmware command and release it with pm_runtime_put_autosuspend(), matching the runtime PM handling already done in wave5_vpu_dec_device_run().",
  "id": "DEBIAN-CVE-2026-89866",
  "modified": "2026-09-17T04:47:26.204138230Z",
  "published": "2026-09-16T11:16:54.743Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89866"
    }
  ],
  "upstream": [
    "CVE-2026-89866"
  ]
}