CVE-2026-43293

In the Linux kernel, the following vulnerability has been resolved:

media: chips-media: wave5: Fix kthread worker destruction in polling mode

Fix the cleanup order in polling mode (irq < 0) to prevent kernel warnings

during module removal. Cancel the hrtimer before destroying the kthread

worker to ensure work queues are empty.

In polling mode, the driver uses hrtimer to periodically trigger

wave5_vpu_timer_callback() which queues work via kthread_queue_work().

The kthread_destroy_worker() function validates that both work queues

are empty with WARN_ON(!list_empty(&worker->work_list)) and

WARN_ON(!list_empty(&worker->delayed_work_list)).

The original code called kthread_destroy_worker() before hrtimer_cancel(),

creating a race condition where the timer could fire during worker

destruction and queue new work, triggering the WARN_ON.

This causes the following warning on every module unload in polling mode:

------------[ cut here ]------------

WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430

kthread_destroy_worker+0x84/0x98

Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...

Call trace:

kthread_destroy_worker+0x84/0x98

wave5_vpu_remove+0xc8/0xe0 [wave5]

platform_remove+0x30/0x58

...

---[ end trace 0000000000000000 ]---