Skip to main content

Linux Kernel CVE-2026-43263

| EUVDEUVD-2026-27660 HIGH
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-96q3-68gv-9r3h
Linux Null Pointer Dereference Denial Of Service Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
May 08, 2026 - 13:44 vuln.today
CVSS changed
May 08, 2026 - 13:22 NVD
7.8 (HIGH)
CVE Published
May 06, 2026 - 11:28 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: chips-media: wave5: Fix Null reference while testing fluster

When multi instances are created/destroyed, many interrupts happens and structures for decoder are removed. "struct vpu_instance" this structure is shared for all flow in the decoder, so if the structure is not protected by lock, Null dereference could happens sometimes. IRQ Handler was spilt to two phases and Lock was added as well.

AnalysisAI

A race condition in the Linux kernel's chips-media wave5 video decoder driver allows local authenticated users to trigger a NULL pointer dereference during concurrent instance creation/destruction, potentially leading to high confidentiality, integrity, and availability impact. The vulnerability affects kernel versions from commit 9707a6254a8a onwards until patched in 6.18.16, 6.19.6, and 7.0. Fixed via interrupt handler refactoring with proper locking. EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability, and no public exploit code or CISA KEV listing exists, suggesting limited real-world exploitation despite the high CVSS 7.8 score.

Technical ContextAI

The vulnerability resides in the chips-media wave5 hardware video codec driver (drivers/media/platform/chips-media/wave5/) in the Linux kernel. The wave5 driver manages Chips&Media's WAVE5 series video encoder/decoder IP cores used in various SoC platforms. The core issue is an unsynchronized shared data structure (struct vpu_instance) accessed from both normal execution context and interrupt handler context. When multiple decoder instances undergo rapid creation and destruction cycles (as occurs during conformance testing with tools like Fluster), the interrupt handler can access freed or partially-initialized vpu_instance structures. The fix splits the IRQ handler into two phases and introduces proper locking primitives to serialize access to the shared structure, preventing the race window. This follows a classic time-of-check-time-of-use (TOCTOU) pattern in kernel driver interrupt handling where multi-phase operations on shared state require atomic protection.

RemediationAI

Upgrade to patched Linux kernel versions 6.18.16, 6.19.6, or 7.0 or later, available from kernel.org stable branches (https://git.kernel.org/stable/c/ea316b784fe6a61b29131c98cddb24e651b1dcbc for 6.18, https://git.kernel.org/stable/c/d12bcf183ec7da4305d848068d15f18044eaf62a for 6.19, https://git.kernel.org/stable/c/e66ff2b08e4ee1c4d3b84f24818e5bcc178cc3a4 for mainline). Distribution-specific kernels will incorporate these fixes in their security update channels. If immediate patching is infeasible, blacklist the wave5 driver module (add 'blacklist wave5' to /etc/modprobe.d/blacklist.conf and rebuild initramfs) to prevent loading, though this disables hardware video acceleration on affected systems. Monitor for kernel panics or oops messages referencing wave5_irq or vpu_instance as potential exploitation indicators. No workaround preserves driver functionality; the locking fix is mandatory for safe concurrent operation. Compensating control trade-off: blacklisting eliminates risk but degrades video decode performance to software-only fallback.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Null Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43263 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy