PT-2026-38943 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43301

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A PM runtime usage count underflow exists in the wave5 driver. The driver unconditionally calls the pm runtime put sync() function during the remove path, which may conflict with the pm runtime use autosuspend() function called during probe. If the device is already suspended due to autosuspend, the usage count is 0, and calling pm runtime put sync() decrements it to -1, leading to a kernel warning during module unload.

Recommendations Replace the pm runtime put sync() function with pm runtime dont use autosuspend() in the remove path to ensure proper pairing with the probe function and allow pm runtime disable() to handle reference count cleanup correctly.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-43301

Affected Products

Linux Kernel

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2026-43301 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43301 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43301 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43301 · Vendor Advisory
• https://git.kernel.org/stable/c/3a278a55ead50db2444c8f01410c7f5a68723990 · Patch
• https://git.kernel.org/stable/c/0bffda02317989f8d5cdc2d4462a4110b1290cf0 · Patch
• https://cve.org/CVERecord?id=CVE-2026-43301 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-43301 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43301 · Vendor Advisory
• https://git.kernel.org/stable/c/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38 · Patch
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://twitter.com/CVEnew/status/2053174642727121289 · Twitter Post
• https://t.me/cveNotify/163611 · Telegram Post
• https://git.kernel.org/linus/9cf4452e824c1e2d41c9c0b13cc8a32a0a7dec38 · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-43301 · Note