PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43247 Linux CVE debrief

CVE-2026-43247 affects the Linux kernel’s chips-media wave5 media driver and can lead to an asynchronous SError and kernel panic. The issue was observed while testing fluster, where an autosuspend delay timeout could cause the device to enter suspend mode at the wrong time. NVD rates the issue as CVSS 5.5/Medium, with local attack conditions and high availability impact. Patched kernel references are provided in the official stable git links.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-06
Original CVE updated
2026-05-11
Advisory published
2026-05-06
Advisory updated
2026-05-11

Who should care

Linux kernel maintainers, distribution security teams, and operators of embedded or appliance systems that use the chips-media wave5 decoder driver, especially where V4L2/media decode workloads are active. Systems running affected kernel versions in the NVD range should be prioritized for review.

Technical summary

The supplied kernel description says the wave5 driver could hit a rare SError kernel panic during queueing/clear-display-flag operations when an autosuspend delay expired and the device entered suspend mode unexpectedly. The crash trace shows the fault in wave5_dec_clr_disp_flag() and propagates through the V4L2 queueing path into a full kernel panic. NVD marks the issue as affecting Linux kernel versions 6.13 up to, but not including, 6.18.16, and 6.19 up to, but not including, 6.19.6. Official stable kernel patch references are listed in the source corpus.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade to a Linux kernel release that includes the official fixes referenced in the stable git links.
  • If you maintain downstream kernels, backport the wave5 fixes into your supported branches.
  • Review whether your systems use the chips-media wave5 media driver and whether autosuspend is enabled for the affected hardware path.
  • Test media decode and suspend/resume behavior after patching to confirm the panic no longer reproduces.
  • Monitor for kernel logs showing asynchronous SError, wave5_dec_clr_disp_flag, or autosuspend-related timing issues.

Evidence notes

Evidence comes from the CVE description and NVD metadata in the supplied corpus. The description explicitly states that the root cause was entering suspend mode because an autosuspend delay timed out, and it includes a panic trace pointing to wave5_dec_clr_disp_flag(). NVD lists the vulnerability as analyzed, provides the affected Linux kernel version ranges, and links three official kernel.org stable patch references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43247 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43247

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43247 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43247

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/27cb12b7dc88c51582094eeb2b65b0e94603e411

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5da55243fe190c2165ed34e77091a43c0ff74f10

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cbb9c0d50e471483cced55f5b7db4569dcd959a6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.