CVE-2026-43293
Race Condition in Linux Kernel Wave5 Driver Polling Mode
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by correcting the cleanup order in polling mode to cancel the hrtimer before destroying the kthread worker. To mitigate this vulnerability immediately, you should update the Linux kernel to a version that includes this fix.
Until the update is applied, avoid unloading the affected module (wave5) in polling mode to prevent the kernel warnings and potential instability caused by the race condition.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's chips-media wave5 driver when operating in polling mode. The issue is related to the improper cleanup order during module removal, where the kernel thread worker is destroyed before canceling a high-resolution timer (hrtimer). This creates a race condition where the timer can still fire and queue new work while the worker is being destroyed, causing kernel warnings.
Specifically, the driver uses an hrtimer to periodically trigger a callback that queues work via kthread_queue_work(). The function kthread_destroy_worker() expects both work queues to be empty, but because the timer is not canceled first, new work can be added during destruction, triggering warnings.
How can this vulnerability impact me? :
This vulnerability can cause kernel warnings during module removal in polling mode, which may lead to instability or unexpected behavior in the system. While it does not describe a direct security breach, the race condition and warnings could potentially affect system reliability or complicate debugging and maintenance.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel warnings during module unload in polling mode. Specifically, the system logs will show warnings related to kthread_destroy_worker and work queue lists not being empty.
You can check for these warnings by examining the kernel log using commands such as:
- dmesg | grep -i 'kthread_destroy_worker'
- journalctl -k | grep -i 'kthread_destroy_worker'
- dmesg | grep -i 'WARNING: CPU'
These commands will help identify the presence of the specific WARN_ON messages triggered by the race condition during module removal.