CVE-2026-23253

Vulnerability

In the Linux kernel's DVB subsystem, the function dvb_dvr_open() calls dvb_ringbuffer_init() each time a new reader opens the DVR device. This reinitializes the waitqueue head (init_waitqueue_head()) inside the shared dmxdev->dvr_buffer.queue structure. Because the waitqueue is shared across all opens of the same DVR device, resetting the list head to {self, self} orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers [1][2].

Exploitation

An attacker with local access and the ability to open the DVR device multiple times (e.g., via /dev/dvb/adapter0/dvr0) can trigger the bug by having one file descriptor register a poll or io_uring wait on the buffer, then opening a second file descriptor on the same device. The second open reinitializes the shared waitqueue, corrupting the list of waiters. No special privileges beyond access to the DVR device node are required; the attack surface is local and unprivileged in typical configurations.

Impact

Successful exploitation can lead to use-after-free or list corruption in the kernel, potentially resulting in a denial of service (system crash) or, in some cases, arbitrary code execution due to corrupted kernel memory. The CVSS v3 score of 7.8 reflects the high impact on confidentiality, integrity, and availability given local access.

Mitigation

The fix replaces the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of buffer data/size and a call to dvb_ringbuffer_reset(), which resets read/write positions without touching the waitqueue or spinlock [1][2][3][4]. The patch has been applied to the stable kernel trees; users should update to a kernel containing the commit bfbc0b5b32a8 or later.