An incorrect routine in the Linux kernel’s DVB subsystem reinitializes a shared waitqueue each time a new reader opens a DVR device. The function used resets the waitqueue head, causing any existing waitqueue entries linked to io_uring or epoll to become orphaned with stale pointers. When the kernel later processes these entries, it can trigger a crash or hang, effectively denying service to all users of the affected device and possibly destabilizing the system.

The flaw resides solely in the kernel’s dvb-core module, which is included in virtually every Linux distribution that enables DVB support. All kernel versions that compile or link with dvb-core are potentially vulnerable until the update is applied. Users who expose /dev/dvb/dvr devices—such as media servers, set‑top boxes, or embedded devices—are at risk.

The CVSS score of 7.8 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker with local access to the DVR device (e.g., a user able to open /dev/dvb/dvrX) can trigger the flaw, causing a kernel crash or service disruption. The attack vector is primarily local; remote exploitation would require the ability to interact with the device through privileged channels.