CVE-2026-43229: Linux Kernel Wave5 VPU DOS Vulnerability

CVE-2026-43229 Overview

CVE-2026-43229 is a Linux kernel vulnerability in the chips-media: wave5 media driver. The flaw stems from an incorrect device cleanup order in the driver's remove function. Power management runtime was disabled and hardware powered down before video devices were unregistered. This left the worker thread reachable through an active hrtimer after the hardware lost power.

When autosuspend powers off the hardware, wave5_vpu_timer_callback() continues queuing work that calls wave5_vdi_read_register() against powered-off hardware. The result is a synchronous external abort and kernel panic during encoding operations on systems using the wave5 Video Processing Unit (VPU) driver.

Critical Impact
Random kernel panics occur during encoding workloads when the wave5 driver is removed or when PM runtime autosuspend triggers, leading to system-wide denial of service.

Affected Products

Linux kernel media: chips-media: wave5 driver
Systems using Chips&Media Wave5 VPU hardware in polling mode
Linux stable branches receiving the referenced kernel commits

Discovery Timeline

2026-05-06 - CVE-2026-43229 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43229

Vulnerability Analysis

The vulnerability is a use-after-power-down condition in the wave5 media driver's removal path. The driver supports a polling mode that uses an hrtimer to periodically invoke wave5_vpu_timer_callback(). That callback queues work onto a kthread worker, which executes wave5_vpu_irq_work_fn() and accesses memory-mapped hardware registers via wave5_vdi_read_register().

The original remove function disabled PM runtime and powered down the VPU hardware before unregistering the video devices. Because the video devices remained registered, the hrtimer kept firing and the worker thread kept executing register reads against a now-unpowered device. The kernel responds to MMIO access on powered-off hardware with a synchronous external abort, producing a fatal exception.

Root Cause

The defect is an ordering bug between teardown steps. Resources required to satisfy in-flight callbacks were released before the producers of those callbacks were stopped. Specifically, pm_runtime_disable() and hardware power-off ran ahead of video_unregister_device(), leaving the timer and worker active after the device became inaccessible [CWE-416 class behavior].

Attack Vector

This is a local reliability defect rather than a remotely reachable code path. A privileged operation that triggers driver removal or PM runtime autosuspend during active encoding can crash the kernel. The reported call trace shows the failure originating in wave5_vdi_read_register+0x10/0x38, called from wave5_vpu_irq_work_fn, executed by kthread_worker_fn. The crash signature is synchronous external abort: 0000000096000010 followed by Kernel panic - not syncing: Fatal exception.

The vulnerability manifests during normal encoding workloads when autosuspend conditions are met. No verified proof-of-concept code is published. See the upstream fix commits for technical details: Kernel Git Commit 526816f, Kernel Git Commit b73d852, Kernel Git Commit b74ceda, and Kernel Git Commit dc2b7de.

Detection Methods for CVE-2026-43229

Indicators of Compromise

Kernel log entries containing synchronous external abort: 0000000096000010 on systems running the wave5 driver.
Stack traces showing wave5_vdi_read_register and wave5_vpu_irq_work_fn immediately before a panic.
Process name vpu_irq_thread appearing in panic output during or after encoding sessions.
Repeated panics correlated with wave5 module unload or PM runtime autosuspend events.

Detection Strategies

Parse dmesg and /var/log/kern.log for the wave5 module name combined with Internal error or Kernel panic strings.
Monitor kernel Tainted: G M W markers appearing alongside wave5 symbols, indicating prior machine check or warning conditions.
Track unexpected reboots on devices integrating Chips&Media Wave5 VPU silicon, particularly during video encoding.

Monitoring Recommendations

Forward kernel logs from VPU-equipped Linux hosts to a centralized logging or SIEM platform for correlation.
Alert on kthread panics referencing wave5_* symbols and on PM runtime suspend events near encoder activity.
Track running kernel versions across the fleet to confirm patched builds are deployed on all affected systems.

How to Mitigate CVE-2026-43229

Immediate Actions Required

Apply the upstream Linux kernel patches that reorder the wave5 remove function so video device unregistration runs first.
Update to a Linux stable release containing commits 526816f, b73d852, b74ceda, or dc2b7de for your maintained branch.
On systems where patching is not yet possible, avoid hot-removing the wave5 module during encoding workloads.

Patch Information

The fix moves video_unregister_device() to the beginning of the driver's remove function. This stops video operations and quiesces the hrtimer and kthread worker before PM runtime is disabled and hardware is powered down. Patches are available across multiple stable trees: Kernel Git Commit 526816f, Kernel Git Commit b73d852, Kernel Git Commit b74ceda, and Kernel Git Commit dc2b7de.

Workarounds

Disable PM runtime autosuspend on the wave5 device to prevent the hardware from powering off while the worker remains active.
Avoid module unload or system suspend during active encoder sessions on unpatched kernels.
Where the wave5 VPU is not required, blacklist the wave5 kernel module to eliminate the affected code path.

bash

# Prevent autosuspend on the wave5 device until kernel is patched
echo -1 > /sys/bus/platform/devices/<wave5-device>/power/autosuspend_delay_ms
echo on > /sys/bus/platform/devices/<wave5-device>/power/control

# Optional: blacklist the module if VPU is unused
echo 'blacklist wave5' > /etc/modprobe.d/blacklist-wave5.conf