CVE-2026-43293media: chips-media: wave5: Fix kthread worker destruction in polling mode
- 5.5MediumCVSS base score
- 0.12%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix kthread worker destruction in polling mode Fix the cleanup order in polling mode (irq < 0) to prevent kernel warnings during module removal. Cancel the hrtimer before destroying the kthread worker to ensure work queues are empty. In polling mode, the driver uses hrtimer to periodically trigger wave5_vpu_timer_callback() which queues work via kthread_queue_work(). The kthread_destroy_worker() function validates that both work queues are empty with WARN_ON(!list_empty(&worker->work_list)) and WARN_ON(!list_empty(&worker->delayed_work_list)). The original code called kthread_destroy_worker() before hrtimer_cancel(), creating a race condition where the timer could fire during worker destruction and queue new work, triggering the WARN_ON. This causes the following warning on every module unload in polling mode: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430 kthread_destroy_worker+0x84/0x98 Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ... Call trace: kthread_destroy_worker+0x84/0x98 wave5_vpu_remove+0xc8/0xe0 [wave5] platform_remove+0x30/0x58 ... ---[ end trace 0000000000000000 ]---
Timeline
ID reserved
By Linux
- 7 days later
· 7 days later
Published
- 3 days later
· 3 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.12% · top 98% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected ed7276ed2fd02208bfca9f222ef1e7b2743d710d – < 156020e889edf4593870d926d3c4a6d06baac44a
- affected ed7276ed2fd02208bfca9f222ef1e7b2743d710d – < cc8071b1bac6568ea09d54be2d4f74dba80e17f8
- affected ed7276ed2fd02208bfca9f222ef1e7b2743d710d – < 0c2e752688a0ee3b89993e6de6c496d863870c93
- affected ed7276ed2fd02208bfca9f222ef1e7b2743d710d – < 5a0c122e834b2f7f029526422c71be922960bf03
- affected 6.10
- unaffected < 6.10
- unaffected 6.12.75 – ≤ 6.12.*
- unaffected 6.18.16 – ≤ 6.18.*
- unaffected 6.19.6 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References4
- https://git.kernel.org/stable/c/156020e889edf4593870d926d3c4a6d06baac44a (opens in a new tab)
- https://git.kernel.org/stable/c/cc8071b1bac6568ea09d54be2d4f74dba80e17f8 (opens in a new tab)
- https://git.kernel.org/stable/c/0c2e752688a0ee3b89993e6de6c496d863870c93 (opens in a new tab)
- https://git.kernel.org/stable/c/5a0c122e834b2f7f029526422c71be922960bf03 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-28563 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-43293)Record last updated .