In the Linux kernel’s DVB subsystem, the routine that initializes a ringbuffer during a new DVR device open incorrectly reinitializes the shared waitqueue head. This action removes existing waitqueue entries that are being monitored through io_uring or epoll, leaving them with stale pointers. When the kernel later processes any of those orphaned entries, it can trigger a crash or hang, effectively denying service for all users of the affected DVR device and potentially destabilizing the whole system.

The flaw resides exclusively in the Linux kernel’s dvb-core module. All Linux distributions that include DVB support are potentially vulnerable until the corresponding kernel patch is applied. Users who expose /dev/dvb/dvr devices—such as media servers, set‑top boxes, or embedded devices—are at risk. No specific version information is available from the CNA data, so all kernel releases that compile with dvb-core should be treated as exposed by default.

The CVSS base score of 7.8 denotes a high severity risk, but the EPSS score of less than 1% indicates that exploitation is unlikely under current conditions. The vulnerability is not listed in the CISA KEV catalog. An attacker must have local access to the DVR device; for example, a user capable of opening /dev/dvb/dvrX. The primary attack vector is therefore local, and remote exploitation would require a privileged side channel capable of interacting with the device.