CVE-2026-43293 (GCVE-0-2026-43293)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:11 – Updated: 2026-05-11 22:21
VLAI
Title
media: chips-media: wave5: Fix kthread worker destruction in polling mode
Summary
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix kthread worker destruction in polling mode Fix the cleanup order in polling mode (irq < 0) to prevent kernel warnings during module removal. Cancel the hrtimer before destroying the kthread worker to ensure work queues are empty. In polling mode, the driver uses hrtimer to periodically trigger wave5_vpu_timer_callback() which queues work via kthread_queue_work(). The kthread_destroy_worker() function validates that both work queues are empty with WARN_ON(!list_empty(&worker->work_list)) and WARN_ON(!list_empty(&worker->delayed_work_list)). The original code called kthread_destroy_worker() before hrtimer_cancel(), creating a race condition where the timer could fire during worker destruction and queue new work, triggering the WARN_ON. This causes the following warning on every module unload in polling mode: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430 kthread_destroy_worker+0x84/0x98 Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ... Call trace: kthread_destroy_worker+0x84/0x98 wave5_vpu_remove+0xc8/0xe0 [wave5] platform_remove+0x30/0x58 ... ---[ end trace 0000000000000000 ]---
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ed7276ed2fd02208bfca9f222ef1e7b2743d710d , < 156020e889edf4593870d926d3c4a6d06baac44a (git)
Affected: ed7276ed2fd02208bfca9f222ef1e7b2743d710d , < cc8071b1bac6568ea09d54be2d4f74dba80e17f8 (git)
Affected: ed7276ed2fd02208bfca9f222ef1e7b2743d710d , < 0c2e752688a0ee3b89993e6de6c496d863870c93 (git)
Affected: ed7276ed2fd02208bfca9f222ef1e7b2743d710d , < 5a0c122e834b2f7f029526422c71be922960bf03 (git)
Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/chips-media/wave5/wave5-vpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "156020e889edf4593870d926d3c4a6d06baac44a",
              "status": "affected",
              "version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d",
              "versionType": "git"
            },
            {
              "lessThan": "cc8071b1bac6568ea09d54be2d4f74dba80e17f8",
              "status": "affected",
              "version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d",
              "versionType": "git"
            },
            {
              "lessThan": "0c2e752688a0ee3b89993e6de6c496d863870c93",
              "status": "affected",
              "version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d",
              "versionType": "git"
            },
            {
              "lessThan": "5a0c122e834b2f7f029526422c71be922960bf03",
              "status": "affected",
              "version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/chips-media/wave5/wave5-vpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Fix kthread worker destruction in polling mode\n\nFix the cleanup order in polling mode (irq \u003c 0) to prevent kernel warnings\nduring module removal. Cancel the hrtimer before destroying the kthread\nworker to ensure work queues are empty.\n\nIn polling mode, the driver uses hrtimer to periodically trigger\nwave5_vpu_timer_callback() which queues work via kthread_queue_work().\nThe kthread_destroy_worker() function validates that both work queues\nare empty with WARN_ON(!list_empty(\u0026worker-\u003ework_list)) and\nWARN_ON(!list_empty(\u0026worker-\u003edelayed_work_list)).\n\nThe original code called kthread_destroy_worker() before hrtimer_cancel(),\ncreating a race condition where the timer could fire during worker\ndestruction and queue new work, triggering the WARN_ON.\n\nThis causes the following warning on every module unload in polling mode:\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430\n    kthread_destroy_worker+0x84/0x98\n  Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...\n  Call trace:\n   kthread_destroy_worker+0x84/0x98\n   wave5_vpu_remove+0xc8/0xe0 [wave5]\n   platform_remove+0x30/0x58\n  ...\n  ---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:21:45.305Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/156020e889edf4593870d926d3c4a6d06baac44a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc8071b1bac6568ea09d54be2d4f74dba80e17f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c2e752688a0ee3b89993e6de6c496d863870c93"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a0c122e834b2f7f029526422c71be922960bf03"
        }
      ],
      "title": "media: chips-media: wave5: Fix kthread worker destruction in polling mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43293",
    "datePublished": "2026-05-08T13:11:16.812Z",
    "dateReserved": "2026-05-01T14:12:55.999Z",
    "dateUpdated": "2026-05-11T22:21:45.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43293",
      "date": "2026-05-28",
      "epss": "0.00013",
      "percentile": "0.02161"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43293\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-08T14:16:36.377\",\"lastModified\":\"2026-05-14T19:50:34.370\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: chips-media: wave5: Fix kthread worker destruction in polling mode\\n\\nFix the cleanup order in polling mode (irq \u003c 0) to prevent kernel warnings\\nduring module removal. Cancel the hrtimer before destroying the kthread\\nworker to ensure work queues are empty.\\n\\nIn polling mode, the driver uses hrtimer to periodically trigger\\nwave5_vpu_timer_callback() which queues work via kthread_queue_work().\\nThe kthread_destroy_worker() function validates that both work queues\\nare empty with WARN_ON(!list_empty(\u0026worker-\u003ework_list)) and\\nWARN_ON(!list_empty(\u0026worker-\u003edelayed_work_list)).\\n\\nThe original code called kthread_destroy_worker() before hrtimer_cancel(),\\ncreating a race condition where the timer could fire during worker\\ndestruction and queue new work, triggering the WARN_ON.\\n\\nThis causes the following warning on every module unload in polling mode:\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430\\n    kthread_destroy_worker+0x84/0x98\\n  Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...\\n  Call trace:\\n   kthread_destroy_worker+0x84/0x98\\n   wave5_vpu_remove+0xc8/0xe0 [wave5]\\n   platform_remove+0x30/0x58\\n  ...\\n  ---[ end trace 0000000000000000 ]---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"CB67FC73-CF7B-41DB-A5A5-423C53BE93EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c2e752688a0ee3b89993e6de6c496d863870c93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/156020e889edf4593870d926d3c4a6d06baac44a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a0c122e834b2f7f029526422c71be922960bf03\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cc8071b1bac6568ea09d54be2d4f74dba80e17f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.