Linux Kernel CVE-2026-43301

The Linux kernel's power management subsystem uses reference counting to track active device usage via pm_runtime APIs. The wave5 video codec driver enables autosuspend in its probe function with pm_runtime_use_autosuspend(), allowing the device to suspend automatically after a timeout. During device removal, the driver unconditionally calls pm_runtime_put_sync() to decrement the usage counter, but this operation does not account for scenarios where autosuspend has already suspended the device and brought the usage count to zero. When pm_runtime_put_sync() executes on an already-suspended device with a zero usage count, it decrements the counter to -1, violating the invariant that pm_runtime reference counts must remain non-negative. CWE-191 classifies this as an integer underflow condition. The proper sequence is to call pm_runtime_dont_use_autosuspend() to disable autosuspend before final cleanup, allowing pm_runtime_disable() to correctly manage the reference count regardless of the current suspend state.