CVE-2026-43301

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: chips-media: wave5: Fix PM runtime usage count underflow

Replace pm_runtime_put_sync() with pm_runtime_dont_use_autosuspend() in

the remove path to properly pair with pm_runtime_use_autosuspend() from

probe. This allows pm_runtime_disable() to handle reference count cleanup

correctly regardless of current suspend state.

The driver calls pm_runtime_put_sync() unconditionally in remove, but the

device may already be suspended due to autosuspend configured in probe.

When autosuspend has already suspended the device, the usage count is 0,

and pm_runtime_put_sync() decrements it to -1.

This causes the following warning on module unload:

------------[ cut here ]------------

WARNING: CPU: 1 PID: 963 at kernel/kthread.c:1430

kthread_destroy_worker+0x84/0x98

...

vdec 30210000.video-codec: Runtime PM usage count underflow!

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References