CVE-2026-43229 Linux内核wave5驱动清理顺序错误致崩溃

/* * Conceptual PoC for CVE-2026-43229 * Triggering the race condition requires specific hardware and kernel state. * This snippet illustrates the vulnerable code flow. */ // Vulnerable sequence (Original Code) void vulnerable_remove(struct platform_device *pdev) { struct vpu_device *vdev = platform_get_drvdata(pdev); // 1. Disable PM runtime and power down hardware pm_runtime_disable(&pdev->dev); // Hardware is OFF now, but video device is still registered // 2. If hrtimer fires here, worker tries to access powered-off HW -> Panic // 3. Unregister video device (Too late) video_unregister_device(vdev->vfd); } // Fixed sequence (Patch) void fixed_remove(struct platform_device *pdev) { struct vpu_device *vdev = platform_get_drvdata(pdev); // 1. Unregister video device first video_unregister_device(vdev->vfd); // Video operations are stopped, timers/workers are halted // 2. Safe to disable PM and power down pm_runtime_disable(&pdev->dev); }