CVE-2026-43229

Vulnerability

In the Linux kernel's chips-media wave5 driver, the device removal path was ordered incorrectly, leading to a race condition that could cause a kernel panic. The remove function disabled power management and powered down the hardware before unregistering video devices. This left a window where the hrtimer-triggered worker thread could still fire and attempt to read hardware registers after the device was already powered down [1].

Exploitation

An attacker with local access and the ability to trigger video encoding operations could exploit this race condition. The period hrtimer in polling mode, via wave5_vpu_timer_callback(), queues work to the kthread worker, which then calls wave5_vpu_irq_work_fn(). This function reads hardware registers using wave5_vdi_read_register(). If the hardware is powered down (e.g., through autosuspend) before the video devices are unregistered, the register read accesses power-managed hardware, causing a synchronous external abort [1].

The race is observed specifically during encoding operations, as indicated by the kernel crash trace showing the vpu_irq_thread worker stuck in wave5_vdi_read_register [1].

Impact

Successful exploitation results in a kernel panic (synchronous external abort), causing a denial of service on the affected system. The crash trace shows a "Kernel panic - not syncing" exact message. No privilege escalation or data leak is documented from this vulnerability [1].

Mitigation

The fix moves video device unregistration to the start of the remove function, ensuring all video operations stop before the hardware is powered down. This eliminates the race window. The patch is applied via stable kernel commits [1][2][3][4]. Users should update their kernel to a version incorporating this fix. No workaround is mentioned.