CVE-2026-23253
Analyzed Analyzed - Analysis Complete
Waitqueue Reinitialization Flaw in Linux DVB Core Causes Stale Pointers

Publication date: 2026-03-18

Last updated on: 2026-06-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty. Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}. The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions. Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-06-01
Generated
2026-06-16
AI Q&A
2026-03-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23253
EUVD
EUVD-2026-12860
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.19 (inc) to 6.19.7 (exc)
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.17 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.130 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.77 (exc)
linux linux_kernel From 5.11 (inc) to 5.15.203 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.167 (exc)
linux linux_kernel From 2.6.17 (inc) to 5.10.253 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

The vulnerability is fixed by replacing the call to dvb_ringbuffer_init() in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error without touching the waitqueue or spinlock.

To mitigate this vulnerability, update your Linux kernel to a version that includes this fix in the dvb-core media subsystem.

Executive Summary

This vulnerability exists in the Linux kernel's media dvb-core component, specifically in the handling of the DVR device's ringbuffer during reopen operations.

When the DVR device is reopened, the function dvb_dvr_open() calls dvb_ringbuffer_init(), which reinitializes the waitqueue list head to empty. However, this waitqueue is shared among all opens of the same DVR device, so resetting it orphaned existing waitqueue entries used by io_uring poll or epoll, leaving them with stale pointers.

The correct behavior is to avoid reinitializing the waitqueue and spinlock on reopen, as they are already properly initialized once. Instead, only the buffer data pointer, size, and read/write positions should be reset. The fix replaces the dvb_ringbuffer_init() call with direct assignments and a call to dvb_ringbuffer_reset(), which resets necessary fields without affecting the waitqueue or spinlock.

Impact Analysis

This vulnerability can cause the waitqueue entries used for polling or event notification (such as io_uring poll or epoll) to become orphaned with stale pointers. This can lead to unexpected behavior or instability when applications interact with the DVR device, potentially causing failures in event handling or resource management.

Compliance Impact

I don't know

Detection Guidance

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart