CVE-2026-43293: media: chips-media: wave5: Fix kthread worker destruction in polling mode
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Fix kthread worker destruction in polling mode
Fix the cleanup order in polling mode (irq < 0) to prevent kernel warnings during module removal. Cancel the hrtimer before destroying the kthread worker to ensure work queues are empty.
In polling mode, the driver uses hrtimer to periodically trigger wave5vputimercallback() which queues work via kthreadqueuework(). The kthreaddestroyworker() function validates that both work queues are empty with WARNON(!listempty(&worker->worklist)) and WARNON(!listempty(&worker->delayedworklist)).
The original code called kthreaddestroyworker() before hrtimercancel(), creating a race condition where the timer could fire during worker destruction and queue new work, triggering the WARNON.
This causes the following warning on every module unload in polling mode:
------------[ cut here ]------------ WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430 kthreaddestroyworker+0x84/0x98 Modules linked in: wave5(-) rpmsgctrl rpmsgchar ... Call trace: kthreaddestroyworker+0x84/0x98 wave5vpuremove+0xc8/0xe0 [wave5] platformremove+0x30/0x58 ... ---[ end trace 0000000000000000 ]---
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43293?
CVE-2026-43293 has a medium severity rating of 5.5.
How do I fix CVE-2026-43293?
The recommended fix for CVE-2026-43293 is to apply the available patch.
What type of vulnerability is CVE-2026-43293 classified as?
CVE-2026-43293 is classified as a Race Condition vulnerability.
In which software is CVE-2026-43293 found?
CVE-2026-43293 is found in the Linux kernel, specifically related to the wave5 driver.
What are the potential risks associated with CVE-2026-43293?
The risks associated with CVE-2026-43293 include kernel warnings during module removal due to improper cleanup order.