CVE-2026-23253

A flaw was found in the Linux kernel's Digital Video Broadcast (DVB) Digital Video Recorder (DVR) subsystem. A local user can exploit this vulnerability by performing local file operations on the DVR device. This occurs because the dvb_dvr_open function incorrectly reinitializes a shared ringbuffer's waitqueue, leading to orphaned entries and list corruption. This can result in kernel crashes or other unexpected behavior, causing a Denial of Service (DoS).

A kernel bug in the DVB DVR open path can corrupt a shared waitqueue because dvb_dvr_open reinitializes the ringbuffer using dvb_ringbuffer_init on every new reader. The ringbuffer init routine resets the waitqueue head even though the waitqueue is shared across all opens of the same DVR device. If there are existing waitqueue entries from epoll or io_uring poll, reinitializing the list head can orphan those entries and leave them with stale prev and next pointers. This can lead to list corruption and later kernel crashes or other unexpected behavior when the stale entries are processed. The issue is not network reachable and is triggered by local file operations on the DVR device.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module dvb-core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.