PT-2026-26103 · Linux · Linux
Published
2026-03-18
·
Updated
2026-03-18
·
CVE-2026-23253
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
dvb dvr open() calls dvb ringbuffer init() when a new reader opens the
DVR device. dvb ringbuffer init() calls init waitqueue head(), which
reinitializes the waitqueue list head to empty.
Since dmxdev->dvr buffer.queue is a shared waitqueue (all opens of the
same DVR device share it), this orphans any existing waitqueue entries
from io uring poll or epoll, leaving them with stale prev/next pointers
while the list head is reset to {self, self}.
The waitqueue and spinlock in dvr buffer are already properly
initialized once in dvb dmxdev init(). The open path only needs to
reset the buffer data pointer, size, and read/write positions.
Replace the dvb ringbuffer init() call in dvb dvr open() with direct
assignment of data/size and a call to dvb ringbuffer reset(), which
properly resets pread, pwrite, and error with correct memory ordering
without touching the waitqueue or spinlock.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux