CVE-2026-43293

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-43293
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix kthread worker destruction in polling mode Fix the cleanup order in polling mode (irq < 0) to prevent kernel warnings during module removal. Cancel the hrtimer before destroying the kthread worker to ensure work queues are empty. In polling mode, the driver uses hrtimer to periodically trigger wave5_vpu_timer_callback() which queues work via kthread_queue_work(). The kthread_destroy_worker() function validates that both work queues are empty with WARN_ON(!list_empty(&worker->work_list)) and WARN_ON(!list_empty(&worker->delayed_work_list)). The original code called kthread_destroy_worker() before hrtimer_cancel(), creating a race condition where the timer could fire during worker destruction and queue new work, triggering the WARN_ON. This causes the following warning on every module unload in polling mode: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430 kthread_destroy_worker+0x84/0x98 Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ... Call trace: kthread_destroy_worker+0x84/0x98 wave5_vpu_remove+0xc8/0xe0 [wave5] platform_remove+0x30/0x58 ... ---[ end trace 0000000000000000 ]---

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0c2e752688a0ee3b89993e6de6c496d863870c93 Patch
https://git.kernel.org/stable/c/156020e889edf4593870d926d3c4a6d06baac44a Patch
https://git.kernel.org/stable/c/5a0c122e834b2f7f029526422c71be922960bf03 Patch
https://git.kernel.org/stable/c/cc8071b1bac6568ea09d54be2d4f74dba80e17f8 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

11 Nov 2026, 20:10

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: media: chips-media: wave5: Corregir la destrucción del worker kthread en modo de sondeo Corregir el orden de limpieza en modo de sondeo (irq menor que 0) para prevenir advertencias del kernel durante la eliminación del módulo. Cancelar el hrtimer antes de destruir el worker kthread para asegurar que las colas de trabajo estén vacías. En modo de sondeo, el controlador utiliza hrtimer para activar periódicamente wave5_vpu_timer_callback() que encola trabajo a través de kthread_queue_work(). La función kthread_destroy_worker() valida que ambas colas de trabajo estén vacías con WARN_ON(!list_empty( y worker -> work_list)) y WARN_ON(!list_empty( y worker -> delayed_work_list)). El código original llamaba a kthread_destroy_worker() antes de hrtimer_cancel(), creando una condición de carrera donde el temporizador podría activarse durante la destrucción del worker y encolar nuevo trabajo, lo que activaría el WARN_ON. Esto causa la siguiente advertencia en cada descarga de módulo en modo de sondeo: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430 kthread_destroy_worker+0x84/0x98 Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ... Call trace: kthread_destroy_worker+0x84/0x98 wave5_vpu_remove+0xc8/0xe0 [wave5] platform_remove+0x30/0x58 ... ---[ end trace 0000000000000000 ]---
Information

Published : 2026-05-08 14:16

Updated : 2026-11-11 20:10

NVD link : CVE-2026-43293

Mitre link : CVE-2026-43293

CVE.ORG link : CVE-2026-43293

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo