Linux EUVD-2026-12860

The Digital Video Broadcast (DVB) subsystem in the Linux kernel provides userspace access to digital TV tuner hardware through character devices. The DVR (Digital Video Recorder) device uses a ring buffer with associated waitqueues to coordinate I/O between userspace readers and kernel drivers. The dmxdev->dvr_buffer.queue waitqueue is shared across multiple file descriptor opens of the same DVR device. The vulnerability occurs in dvb_dvr_open() (media/dvb-core/dmxdev.c), which incorrectly calls dvb_ringbuffer_init() on every device open. This function reinitializes the waitqueue head via init_waitqueue_head(), setting the doubly-linked list to {self, self}. Any existing waitqueue entries from io_uring async poll operations or epoll file descriptors are orphaned with dangling prev/next pointers still pointing to the old list head location. Subsequent waitqueue operations (wake_up, list traversal) can dereference these stale pointers, creating use-after-free or list corruption conditions. The waitqueue and spinlock are properly initialized once during driver probe in dvb_dmxdev_init(); the reopen path should only reset buffer state (pread, pwrite, error) without touching synchronization primitives. The root cause is architectural confusion between one-time driver initialization and per-open state reset, though no formal CWE classification is assigned in NVD data.