PT-2026-38935 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43293

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the wave5 driver when operating in polling mode. The driver uses an hrtimer to periodically trigger the wave5 vpu timer callback() function, which queues work via kthread queue work(). Because the original code executed kthread destroy worker() before hrtimer cancel(), the timer could fire during the worker destruction process and queue new work. This leads to kernel warnings during module removal when kthread destroy worker() detects that the work queues are not empty.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43293

Affected Products

Linux Kernel

References · 15

• https://git.kernel.org/stable/c/156020e889edf4593870d926d3c4a6d06baac44a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43293 · Security Note
• https://git.kernel.org/stable/c/0c2e752688a0ee3b89993e6de6c496d863870c93 · Patch
• https://ubuntu.com/security/CVE-2026-43293 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43293 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43293 · Vendor Advisory
• https://git.kernel.org/stable/c/cc8071b1bac6568ea09d54be2d4f74dba80e17f8 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43293 · Vendor Advisory
• https://git.kernel.org/stable/c/5a0c122e834b2f7f029526422c71be922960bf03 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-43293 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43293 · Vendor Advisory
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://git.kernel.org/linus/5a0c122e834b2f7f029526422c71be922960bf03 · Note
• https://twitter.com/CVEnew/status/2053174653103870200 · Twitter Post
• https://docs.bell-sw.com/security/cves/CVE-2026-43293 · Note