Improper resource shutdown or release in Linux kernel - CVE-2026-43301
Published: May 9, 2026
Vulnerability identifier: #VU130879
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-43301
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown handling in the wave5 media driver remove path when removing the device after autosuspend has suspended it. A local user can trigger device removal to cause a denial of service.
The issue occurs because the runtime PM usage count can underflow during module unload when the device is already suspended.
Affected software
Linux kernel
How to mitigate CVE-2026-43301
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3