CVE-2026-23253
Description
A flaw was found in the Linux kernel's Digital Video Broadcast (DVB) Digital Video Recorder (DVR) subsystem. A local user can exploit this vulnerability by performing local file operations on the DVR device. This occurs because the dvb_dvr_open function incorrectly reinitializes a shared ringbuffer's waitqueue, leading to orphaned entries and list corruption. This can result in kernel crashes or other unexpected behavior, causing a Denial of Service (DoS).
Statement
A kernel bug in the DVB DVR open path can corrupt a shared waitqueue because dvb_dvr_open reinitializes the ringbuffer using dvb_ringbuffer_init on every new reader. The ringbuffer init routine resets the waitqueue head even though the waitqueue is shared across all opens of the same DVR device. If there are existing waitqueue entries from epoll or io_uring poll, reinitializing the list head can orphan those entries and leave them with stale prev and next pointers. This can lead to list corruption and later kernel crashes or other unexpected behavior when the stale entries are processed. The issue is not network reachable and is triggered by local file operations on the DVR device.
Mitigation
To mitigate this issue, prevent module dvb-core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.2 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | Low | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Other
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
