---
id: CVE-2026-53380
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: rzv2h-ivc: Fix concurrent buffer list access

  The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a
  spinlock (`rzv2h_ivc::buffers.lock`)
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: rzv2h-ivc: Fix concurrent buffer list access

  The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a
  spinlock (`rzv2h_ivc::buffers.lock`). However, i…
severity: none
published: '2026-07-19'
updated: '2026-07-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53380'
references:
  - url: 'https://git.kernel.org/stable/c/72773ff1cdfaebc593f53b1719b2c1773ecf8c43'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c746522bd3264132ab2e2382e96e19cdb8a6c1ba'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
ingestedAt: '2026-07-19T16:31:24.330Z'
epss: 0.00123
epssPercentile: 0.0241
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: rzv2h-ivc: Fix concurrent buffer list access

The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a
spinlock (`rzv2h_ivc::buffers.lock`). However, in
`rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the
`list_del()` call is executed without holding the spinlock, which makes
it possible for the list to be concurrently modified

Fix that by removing a buffer from the list in the lock protected section.

[assign ivc->buffers.curr in critical section as reported by Barnabas]

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.