CVE-2026-43229: media: chips-media: wave5: Fix device cleanup order to prevent kernel panic

Published May 6, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

media: chips-media: wave5: Fix device cleanup order to prevent kernel panic

Move video device unregistration to the beginning of the remove function to ensure all video operations are stopped before cleaning up the worker thread and disabling PM runtime. This prevents hardware register access after the device has been powered down.

In polling mode, the hrtimer periodically triggers wave5vputimercallback() which queues work to the kthread worker. The worker executes wave5vpuirqworkfn() which reads hardware registers via wave5vdireadregister().

The original cleanup order disabled PM runtime and powered down hardware before unregistering video devices. When autosuspend triggers and powers off the hardware, the video devices are still registered and the worker thread can still be triggered by the hrtimer, causing it to attempt reading registers from powered-off hardware. This results in a bus error (synchronous external abort) and kernel panic.

This causes random kernel panics during encoding operations:

Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP Modules linked in: wave5 rpmsgctrl rpmsgchar ... CPU: 0 UID: 0 PID: 1520 Comm: vpuirqthread Tainted: G M W pc : wave5vdireadregister+0x10/0x38 [wave5] lr : wave5vpuirqworkfn+0x28/0x60 [wave5] Call trace: wave5vdireadregister+0x10/0x38 [wave5] kthreadworkerfn+0xd8/0x238 kthread+0x104/0x120 retfromfork+0x10/0x20 Code: aa1e03e9 d503201f f9416800 8b214000 (b9400000) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: synchronous external abort: Fatal exception

Affected Software

4 affected components
Linux Linux kernel (chips-media wave5)
Linux Linux kernel>=6.8<6.12.75
Linux Linux kernel>=6.13<6.18.16
Linux Linux kernel>=6.19<6.19.6

Event History

May 6, 2026
CVE Published
via MITRE·11:28 AM
Data Sourced
via MITRE·11:28 AM
Description
Data Sourced
via NVD·12:16 PM
RemedyDescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-43229?

The severity of CVE-2026-43229 is classified as medium with a CVSS score of 5.5.

2

What type of vulnerability is CVE-2026-43229?

CVE-2026-43229 is a kernel panic vulnerability in the Linux kernel related to device cleanup order.

3

How do I fix CVE-2026-43229?

To fix CVE-2026-43229, apply the available patch that resolves the device cleanup order issue.

4

What effects does CVE-2026-43229 have on system security?

CVE-2026-43229 can potentially lead to kernel panic, causing system instability and downtime.

5

Which software is affected by CVE-2026-43229?

CVE-2026-43229 affects the Linux kernel and specifically the chips-media wave5 component.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203