CVE-2026-23253

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-core: fix wrong reinitialization of ringbuffer on reopen

dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the

DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which

reinitializes the waitqueue list head to empty.

Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the

same DVR device share it), this orphans any existing waitqueue entries

from io_uring poll or epoll, leaving them with stale prev/next pointers

while the list head is reset to {self, self}.

The waitqueue and spinlock in dvr_buffer are already properly

initialized once in dvb_dmxdev_init(). The open path only needs to

reset the buffer data pointer, size, and read/write positions.

Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct

assignment of data/size and a call to dvb_ringbuffer_reset(), which

properly resets pread, pwrite, and error with correct memory ordering

without to

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References