CVE-2026-43301 media: chips-media: wave5: Fix PM runtime usage count underflow
A reference count underflow in the Wave5 video codec driver can cause a kernel warning and potential instability during module unload.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43301?
CVE-2026-43301 is a medium-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Fix PM runtime usage count underflow
Replace pm_runtime_put_sync() with pm_runtime_dont_use_autosuspend() in the remove path to properly pair with pm_runtime_use_autosuspend() from probe. This allows pm_runtime_disable() to handle reference count cleanup correctly regardless of current suspend state.
The driver calls pm_runtime_put_sync() unconditionally in remove, but the device may already be suspended due to autosuspend configured in probe. When autosuspend has already suspended the device, the usage count is 0, and pm_runtime_put_sync() decrements it to -1.
This causes the following warning on module unload:
------------[ cut here ]------------ WARNING: CPU: 1 PID: 963 at kernel/kthread.c:1430 kthread_destroy_worker+0x84/0x98 ... vdec 30210000.video-codec: Runtime PM usage count underflow!
Weakness: CWE-191
Which versions are affected by CVE-2026-43301?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43301?
Apply the vendor's patch.
Is CVE-2026-43301 being exploited?
There is no known exploitation of CVE-2026-43301 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43301, DEBIAN-CVE-2026-43301, GHSA-g77g-v33m-x9rh, ROOT-OS-DEBIAN-13-CVE-2026-43301, ROOT-OS-UBUNTU-2404-CVE-2026-43301, UBUNTU-CVE-2026-43301.