CyberSecBulletin
CVE-2026-23253NVD status: Modified

Linux: Improper Initialization

Published Updated By the CyberSecBulletin desk

CVE-2026-23253 is a high-severity improper initialization vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 527cfa8a3486b3555c5c15e2f62be484a11398dc, fb378cf89be434ed1f10ab79cc4788fba8ae868d, f1e520ca2e83ece6731af6167c9e5e16931ecba0 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 527cfa8a3486b3555c5c15e2f62be484a11398dc or fb378cf89be434ed1f10ab79cc4788fba8ae868d or f1e520ca2e83ece6731af6167c9e5e16931ecba0 or af050ab44fa1b1897a940d7d756e512232f5e5df, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.167 or 6.6.130, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux34731df288a5ffe4b0c396caf8cd24c6a710a222 up to, but not including, 527cfa8a3486b3555c5c15e2f62be484a11398dc; 34731df288a5ffe4b0c396caf8cd24c6a710a222 up to, but not including, fb378cf89be434ed1f10ab79cc4788fba8ae868d; 34731df288a5ffe4b0c396caf8cd24c6a710a222 up to, but not including, f1e520ca2e83ece6731af6167c9e5e16931ecba0; 34731df288a5ffe4b0c396caf8cd24c6a710a222 up to, but not including, af050ab44fa1b1897a940d7d756e512232f5e5df; 34731df288a5ffe4b0c396caf8cd24c6a710a222 up to, but not including, d71781bad59b1c9d60d7068004581f9bf19c0c9d; 34731df288a5ffe4b0c396caf8cd24c6a710a222 up to, but not including, cfd94642025e6f71c8f754bdec0800ee95e4f3dd; 34731df288a5ffe4b0c396caf8cd24c6a710a222 up to, but not including, 32eb8e4adc207ef31bc6e5ae56bab940b0176066; 34731df288a5ffe4b0c396caf8cd24c6a710a222 up to, but not including, bfbc0b5b32a8f28ce284add619bf226716a59bc0; and 1 more ranges527cfa8a3486b3555c5c15e2f62be484a11398dc, fb378cf89be434ed1f10ab79cc4788fba8ae868d, f1e520ca2e83ece6731af6167c9e5e16931ecba0, af050ab44fa1b1897a940d7d756e512232f5e5df, d71781bad59b1c9d60d7068004581f9bf19c0c9d, cfd94642025e6f71c8f754bdec0800ee95e4f3dd
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel2.6.17 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.77; 6.13 up to, but not including, 6.18.17; 6.19 up to, but not including, 6.19.7; 7.05.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty. Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}. The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions. Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Initialization

The product does not initialize or incorrectly initializes a resource.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
  • Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
  • Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.

More Improper Initialization vulnerabilities (CWE-665)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Initialization vulnerabilities

Spotted an error? Tell us.