CVE-2026-23253 media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
A race condition in the Linux kernel DVB core allows local attackers to cause a denial of service by corrupting waitqueue pointers during DVR device reopening.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23253?
CVE-2026-23253 is a high-severity vulnerability in Linux kernel, published on 18 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty.
Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}.
The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions.
Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock.
Weakness: CWE-665
Which versions are affected by CVE-2026-23253?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23253?
Apply the vendor's patch.
Is CVE-2026-23253 being exploited?
There is no known exploitation of CVE-2026-23253 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-80079, BELL-CVE-2026-23253, DEBIAN-CVE-2026-23253, GHSA-2m3p-78c9-6w3j, ROOT-OS-DEBIAN-11-CVE-2026-23253, ROOT-OS-DEBIAN-12-CVE-2026-23253 and 4 more.