CVE-2026-43293

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43293", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.999Z", "datePublished": "2026-05-08T13:11:16.812Z", "dateUpdated": "2026-05-11T22:21:45.305Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:21:45.305Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Fix kthread worker destruction in polling mode\n\nFix the cleanup order in polling mode (irq < 0) to prevent kernel warnings\nduring module removal. Cancel the hrtimer before destroying the kthread\nworker to ensure work queues are empty.\n\nIn polling mode, the driver uses hrtimer to periodically trigger\nwave5_vpu_timer_callback() which queues work via kthread_queue_work().\nThe kthread_destroy_worker() function validates that both work queues\nare empty with WARN_ON(!list_empty(&worker->work_list)) and\nWARN_ON(!list_empty(&worker->delayed_work_list)).\n\nThe original code called kthread_destroy_worker() before hrtimer_cancel(),\ncreating a race condition where the timer could fire during worker\ndestruction and queue new work, triggering the WARN_ON.\n\nThis causes the following warning on every module unload in polling mode:\n\n ------------[ cut here ]------------\n WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430\n kthread_destroy_worker+0x84/0x98\n Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...\n Call trace:\n kthread_destroy_worker+0x84/0x98\n wave5_vpu_remove+0xc8/0xe0 [wave5]\n platform_remove+0x30/0x58\n ...\n ---[ end trace 0000000000000000 ]---"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/chips-media/wave5/wave5-vpu.c"], "versions": [{"version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d", "lessThan": "156020e889edf4593870d926d3c4a6d06baac44a", "status": "affected", "versionType": "git"}, {"version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d", "lessThan": "cc8071b1bac6568ea09d54be2d4f74dba80e17f8", "status": "affected", "versionType": "git"}, {"version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d", "lessThan": "0c2e752688a0ee3b89993e6de6c496d863870c93", "status": "affected", "versionType": "git"}, {"version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d", "lessThan": "5a0c122e834b2f7f029526422c71be922960bf03", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/platform/chips-media/wave5/wave5-vpu.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/156020e889edf4593870d926d3c4a6d06baac44a"}, {"url": "https://git.kernel.org/stable/c/cc8071b1bac6568ea09d54be2d4f74dba80e17f8"}, {"url": "https://git.kernel.org/stable/c/0c2e752688a0ee3b89993e6de6c496d863870c93"}, {"url": "https://git.kernel.org/stable/c/5a0c122e834b2f7f029526422c71be922960bf03"}], "title": "media: chips-media: wave5: Fix kthread worker destruction in polling mode", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/platform/chips-media/wave5/wave5-vpu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "156020e889edf4593870d926d3c4a6d06baac44a", "status": "affected", "version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d", "versionType": "git"}, {"lessThan": "cc8071b1bac6568ea09d54be2d4f74dba80e17f8", "status": "affected", "version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d", "versionType": "git"}, {"lessThan": "0c2e752688a0ee3b89993e6de6c496d863870c93", "status": "affected", "version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d", "versionType": "git"}, {"lessThan": "5a0c122e834b2f7f029526422c71be922960bf03", "status": "affected", "version": "ed7276ed2fd02208bfca9f222ef1e7b2743d710d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/platform/chips-media/wave5/wave5-vpu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.75", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB67FC73-CF7B-41DB-A5A5-423C53BE93EF", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Fix kthread worker destruction in polling mode\n\nFix the cleanup order in polling mode (irq < 0) to prevent kernel warnings\nduring module removal. Cancel the hrtimer before destroying the kthread\nworker to ensure work queues are empty.\n\nIn polling mode, the driver uses hrtimer to periodically trigger\nwave5_vpu_timer_callback() which queues work via kthread_queue_work().\nThe kthread_destroy_worker() function validates that both work queues\nare empty with WARN_ON(!list_empty(&worker->work_list)) and\nWARN_ON(!list_empty(&worker->delayed_work_list)).\n\nThe original code called kthread_destroy_worker() before hrtimer_cancel(),\ncreating a race condition where the timer could fire during worker\ndestruction and queue new work, triggering the WARN_ON.\n\nThis causes the following warning on every module unload in polling mode:\n\n ------------[ cut here ]------------\n WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430\n kthread_destroy_worker+0x84/0x98\n Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...\n Call trace:\n kthread_destroy_worker+0x84/0x98\n wave5_vpu_remove+0xc8/0xe0 [wave5]\n platform_remove+0x30/0x58\n ...\n ---[ end trace 0000000000000000 ]---"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: media: chips-media: wave5: Corregir la destrucci\u00f3n del worker kthread en modo de sondeo Corregir el orden de limpieza en modo de sondeo (irq menor que 0) para prevenir advertencias del kernel durante la eliminaci\u00f3n del m\u00f3dulo. Cancelar el hrtimer antes de destruir el worker kthread para asegurar que las colas de trabajo est\u00e9n vac\u00edas. En modo de sondeo, el controlador utiliza hrtimer para activar peri\u00f3dicamente wave5_vpu_timer_callback() que encola trabajo a trav\u00e9s de kthread_queue_work(). La funci\u00f3n kthread_destroy_worker() valida que ambas colas de trabajo est\u00e9n vac\u00edas con WARN_ON(!list_empty( y worker -> work_list)) y WARN_ON(!list_empty( y worker -> delayed_work_list)). El c\u00f3digo original llamaba a kthread_destroy_worker() antes de hrtimer_cancel(), creando una condici\u00f3n de carrera donde el temporizador podr\u00eda activarse durante la destrucci\u00f3n del worker y encolar nuevo trabajo, lo que activar\u00eda el WARN_ON. Esto causa la siguiente advertencia en cada descarga de m\u00f3dulo en modo de sondeo: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430 kthread_destroy_worker+0x84/0x98 Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ... Call trace: kthread_destroy_worker+0x84/0x98 wave5_vpu_remove+0xc8/0xe0 [wave5] platform_remove+0x30/0x58 ... ---[ end trace 0000000000000000 ]---"}], "id": "CVE-2026-43293", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-08T14:16:36.377", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0c2e752688a0ee3b89993e6de6c496d863870c93"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/156020e889edf4593870d926d3c4a6d06baac44a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a0c122e834b2f7f029526422c71be922960bf03"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cc8071b1bac6568ea09d54be2d4f74dba80e17f8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: media: chips-media: wave5: Fix kthread worker destruction in polling mode", "id": "2468044", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468044"}, "csaw": false, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's wave5 media driver. During the removal of the wave5 module in polling mode, a timing issue, known as a race condition, can occur. This happens because the process that destroys the worker is initiated before the timer that queues work is fully canceled. This can lead to kernel warnings, potentially causing system instability or unexpected behavior when the module is unloaded."], "name": "CVE-2026-43293", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43293\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43293\nhttps://lore.kernel.org/linux-cve-announce/2026050853-CVE-2026-43293-ade7@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed7276ed2fd02208bfca9f222ef1e7b2743d710d,156020e889edf4593870d926d3c4a6d06baac44a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed7276ed2fd02208bfca9f222ef1e7b2743d710d,cc8071b1bac6568ea09d54be2d4f74dba80e17f8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed7276ed2fd02208bfca9f222ef1e7b2743d710d,0c2e752688a0ee3b89993e6de6c496d863870c93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ed7276ed2fd02208bfca9f222ef1e7b2743d710d,5a0c122e834b2f7f029526422c71be922960bf03)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.75,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T15:15:10.521789+00:00", "updated": "2026-05-14T22:30:25.722001+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}