CVE-2026-23253: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
dvbdvropen() calls dvbringbufferinit() when a new reader opens the DVR device. dvbringbufferinit() calls initwaitqueuehead(), which reinitializes the waitqueue list head to empty.
Since dmxdev->dvrbuffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from iouring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}.
The waitqueue and spinlock in dvrbuffer are already properly initialized once in dvbdmxdevinit(). The open path only needs to reset the buffer data pointer, size, and read/write positions.
Replace the dvbringbufferinit() call in dvbdvropen() with direct assignment of data/size and a call to dvbringbufferreset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23253?
The severity of CVE-2026-23253 has not been explicitly rated yet, but it pertains to a critical issue in the Linux kernel affecting DVR device functionality.
How do I fix CVE-2026-23253?
To fix CVE-2026-23253, ensure your Linux kernel is updated to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2026-23253?
CVE-2026-23253 affects the Linux kernel implementations that utilize the DVB core for digital video broadcasting.
What is the impact of CVE-2026-23253?
The impact of CVE-2026-23253 includes potential incorrect reinitialization of the ringbuffer when reopening DVR devices, which could lead to unexpected behaviors.
Is CVE-2026-23253 being actively exploited?
As of now, there have been no public reports indicating active exploitation of CVE-2026-23253, but it is advisable to apply updates promptly.