CVE-2026-43247 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators of embedded or appliance systems that use the chips-media wave5 decoder driver, especially where V4L2/media decode workloads are active. Systems running affected kernel versions in the NVD range should be prioritized for review.

Technical summary

The supplied kernel description says the wave5 driver could hit a rare SError kernel panic during queueing/clear-display-flag operations when an autosuspend delay expired and the device entered suspend mode unexpectedly. The crash trace shows the fault in wave5_dec_clr_disp_flag() and propagates through the V4L2 queueing path into a full kernel panic. NVD marks the issue as affecting Linux kernel versions 6.13 up to, but not including, 6.18.16, and 6.19 up to, but not including, 6.19.6. Official stable kernel patch references are listed in the source corpus.

Defensive priority

Medium

Recommended defensive actions

• Upgrade to a Linux kernel release that includes the official fixes referenced in the stable git links.
• If you maintain downstream kernels, backport the wave5 fixes into your supported branches.
• Review whether your systems use the chips-media wave5 media driver and whether autosuspend is enabled for the affected hardware path.
• Test media decode and suspend/resume behavior after patching to confirm the panic no longer reproduces.
• Monitor for kernel logs showing asynchronous SError, wave5_dec_clr_disp_flag, or autosuspend-related timing issues.

Evidence notes

Evidence comes from the CVE description and NVD metadata in the supplied corpus. The description explicitly states that the root cause was entering suspend mode because an autosuspend delay timed out, and it includes a panic trace pointing to wave5_dec_clr_disp_flag(). NVD lists the vulnerability as analyzed, provides the affected Linux kernel version ranges, and links three official kernel.org stable patch references.

Official resources