Junglewise Threat Intelligence

CVE-2026-23253: Linux Kernel dvb-core ringbuffer corruption in dvb_dvr_open

CVE-2026-23253 · Severity: high · CVSS 7.8 · Published 2026-03-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Digital Video Broadcasting (DVB) subsystem could allow a local user to cause a system crash or potentially gain unauthorized privileges. The issue occurs when a specific media device is reopened, causing internal memory structures to be incorrectly reset while they are still in use. This can lead to system instability or data corruption in environments using DVB hardware or drivers.

Technical details

A vulnerability exists in the dvb-core component of the Linux kernel due to improper reinitialization of the ringbuffer in dvb_dvr_open(). When a new reader opens the DVR device, the code calls dvb_ringbuffer_init(), which in turn triggers init_waitqueue_head(). Because the waitqueue is shared across all opens of the same DVR device, this action resets the list head while existing entries (from io_uring or epoll) are still linked, resulting in 'orphaned' entries with stale pointers. This is a classic linked-list corruption scenario that can lead to use-after-free or kernel panics. The fix involves replacing the full initialization with a targeted reset of buffer pointers and positions that preserves the waitqueue and spinlock state.

Affected products

  • Linux Linux Kernel 2.6.17 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7

Timeline

  • 2026-02-24: other: Patch authored by Jens Axboe
  • 2026-03-18: disclosed: Initial disclosure and CVE assignment
  • 2026-03-18: advisory: NVD published advisory

References