CVE-2026-23253
Waitqueue Reinitialization Flaw in Linux DVB Core Causes Stale Pointers
Publication date: 2026-03-18
Last updated on: 2026-04-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
| linux_kernel | dvb-core | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by replacing the call to dvb_ringbuffer_init() in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error without touching the waitqueue or spinlock.
To mitigate this vulnerability, update your Linux kernel to a version that includes this fix in the dvb-core media subsystem.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's media dvb-core component, specifically in the handling of the DVR device's ringbuffer during reopen operations.
When the DVR device is reopened, the function dvb_dvr_open() calls dvb_ringbuffer_init(), which reinitializes the waitqueue list head to empty. However, this waitqueue is shared among all opens of the same DVR device, so resetting it orphaned existing waitqueue entries used by io_uring poll or epoll, leaving them with stale pointers.
The correct behavior is to avoid reinitializing the waitqueue and spinlock on reopen, as they are already properly initialized once. Instead, only the buffer data pointer, size, and read/write positions should be reset. The fix replaces the dvb_ringbuffer_init() call with direct assignments and a call to dvb_ringbuffer_reset(), which resets necessary fields without affecting the waitqueue or spinlock.
How can this vulnerability impact me? :
This vulnerability can cause the waitqueue entries used for polling or event notification (such as io_uring poll or epoll) to become orphaned with stale pointers. This can lead to unexpected behavior or instability when applications interact with the DVR device, potentially causing failures in event handling or resource management.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know