CVE-2026-43263: Linux Kernel Race Condition Vulnerability

CVE-2026-43263 Overview

CVE-2026-43263 is a null pointer dereference vulnerability in the Linux kernel chips-media: wave5 driver. The flaw resides in the decoder logic that manages multiple concurrent decoder instances. When multiple instances are created and destroyed in quick succession, the driver generates many interrupts while decoder structures are being torn down. The shared struct vpu_instance is accessed across decoder flows without consistent locking, which leads to a null dereference under race conditions. The upstream fix splits the IRQ handler into two phases and adds locking to protect the shared structure.

Critical Impact
A null pointer dereference in the kernel triggers a kernel oops or panic, causing local denial of service on systems using the Wave5 video decoder.

Affected Products

Linux kernel — media: chips-media: wave5 decoder driver
Systems integrating Chips&Media Wave5 video decoders (commonly ARM SoC platforms)
Distributions shipping affected stable kernel branches prior to the upstream fix

Discovery Timeline

2026-05-06 - CVE-2026-43263 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43263

Vulnerability Analysis

The Wave5 driver in drivers/media/platform/chips-media/wave5 exposes V4L2 (Video4Linux version 2) decoder functionality. The driver tracks per-stream state in struct vpu_instance, which is referenced by both user-context teardown paths and the hardware interrupt handler. When userspace creates and destroys multiple decoder instances simultaneously, the IRQ handler can fire while another path is freeing or modifying the same vpu_instance. Because the shared structure is not consistently guarded by a lock, the IRQ handler can dereference fields after they have been cleared or freed, producing a NULL pointer dereference [CWE-476].

The fluster conformance test suite reliably reproduced the race by stressing instance lifecycle operations. The result is a kernel oops in interrupt context, which on most configurations halts the affected CPU and crashes the system.

Root Cause

The root cause is missing synchronization on the shared struct vpu_instance. The decoder data flow assumed serialized access, but the high-frequency interrupt path and the instance destruction path can run concurrently on SMP systems. Without a lock, the IRQ handler observes partially torn-down state and dereferences a NULL field.

Attack Vector

Exploitation requires local access with the ability to open the V4L2 device node and issue ioctls that create and destroy decoder instances rapidly. An unprivileged user with permission to access /dev/video* for the Wave5 device can trigger the race by repeatedly instantiating and tearing down decode sessions, producing a denial of service. The vulnerability is not remotely reachable.

// No verified exploit code is available. The race occurs between
// the Wave5 IRQ handler and the decoder instance destruction path,
// both of which access struct vpu_instance without a shared lock.

Detection Methods for CVE-2026-43263

Indicators of Compromise

Kernel oops or BUG messages in dmesg referencing wave5, vpu_instance, or functions in drivers/media/platform/chips-media/wave5/
Unexpected reboots or CPU lockups on devices using Chips&Media Wave5 decoders
Crash signatures showing NULL pointer dereference in the Wave5 IRQ handler call stack

Detection Strategies

Monitor kernel logs for Unable to handle kernel NULL pointer dereference entries paired with Wave5 symbols.
Audit running kernel versions against the patched commits d12bcf18, e66ff2b0, and ea316b78 to identify unpatched hosts.
Track V4L2 device usage patterns on systems where unprivileged users have access to decoder nodes.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform and alert on oops or panic events.
Inventory kernel build versions across fleets to confirm the Wave5 fix is present.
Review udev and cgroup rules that grant access to /dev/video* to ensure least privilege.

How to Mitigate CVE-2026-43263

Immediate Actions Required

Apply the upstream Linux kernel patches that split the Wave5 IRQ handler into two phases and add locking around struct vpu_instance.
Update to a stable kernel release that includes commits d12bcf18, e66ff2b0, and ea316b78.
Restrict access to Wave5 V4L2 device nodes to trusted users and services until the patch is deployed.

Patch Information

The fix is delivered through three upstream commits in the Linux kernel stable tree. The patches restructure the Wave5 interrupt handling and introduce a lock that protects the shared decoder instance structure. See the Kernel Git Commit - Patch, Kernel Git Commit - Update, and Kernel Git Commit - Fix for the source changes. Distribution vendors will backport these commits into supported stable branches.

Workarounds

Unload the wave5 kernel module on systems that do not require hardware video decoding.
Tighten permissions on /dev/video* nodes so only privileged services can open the Wave5 decoder.
Avoid workloads that rapidly create and destroy multiple decoder instances on unpatched kernels.

bash

# Restrict Wave5 device access and unload the module if unused
sudo chmod 0660 /dev/video*
sudo chown root:video /dev/video*
sudo modprobe -r wave5   # only if hardware decoding is not required