CVE-2026-23253 Linux CVE debrief

Who should care

Linux system administrators, kernel maintainers, embedded device manufacturers using DVB subsystems, security teams managing Linux workstations and servers with DVB hardware, and organizations running containerized or multi-tenant environments where untrusted users may have access to DVB device nodes

Technical summary

The vulnerability is a use-after-free condition in `drivers/media/dvb-core/dmxdev.c`. The `dvb_dvr_open()` function calls `dvb_ringbuffer_init()` on each new open of a DVR device. This function calls `init_waitqueue_head()`, which resets the waitqueue list head. Because `dmxdev->dvr_buffer.queue` is shared across all opens of the same DVR device, any existing waitqueue entries (from `io_uring` poll, `epoll`, or blocking reads) become orphaned with dangling pointers. The waitqueue and spinlock were already correctly initialized in `dvb_dmxdev_init()`. The fix replaces `dvb_ringbuffer_init()` with direct buffer pointer assignment and `dvb_ringbuffer_reset()`, which resets `pread`, `pwrite`, and `error` with proper memory ordering without reinitializing the waitqueue or spinlock. Attack vector is local, requiring low privileges and no user interaction. Impact is high for confidentiality, integrity, and availability.

Defensive priority

HIGH

Recommended defensive actions

• Apply the relevant stable kernel patch for your branch: 5.10.253 or later, 5.15.203 or later, 6.1.167 or later, 6.6.130 or later, 6.12.77 or later, 6.18.17 or later, 6.19.7 or later, or 7.0-rc1 with the fix included
• Upgrade to a patched Linux kernel version that includes the fix for CVE-2026-23253
• If immediate patching is not possible, restrict access to DVB DVR device nodes (/dev/dvb/adapter*/dvr*) to trusted users only, as local access is required
• Monitor systems for unusual crashes or hangs in DVB-related processes, which may indicate exploitation attempts
• Review custom or out-of-tree DVB drivers for similar patterns of shared waitqueue reinitialization

Evidence notes

The vulnerability was resolved in the Linux kernel media subsystem. The issue was introduced by incorrect reinitialization of a shared ringbuffer waitqueue in `dvb_dvr_open()`. The fix ensures that only buffer data pointers and positions are reset on reopen, preserving the integrity of the shared waitqueue and spinlock that were properly initialized once in `dvb_dmxdev_init()`. Multiple stable kernel branches received patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.