LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23121: mISDN: annotate data-race around dev->work

In the Linux kernel, the following vulnerability has been resolved: mISDN: annotate data-race around dev->work dev->work can re read locklessly in mISDN_read() and mISDN_poll(). Add READ_ONCE()/WRITE_ONCE() annotations. BUG: KCSAN: data-race in mISDN_ioctl / mISDN_read write to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1: misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline] mISDN_ioctl+0x2fb/0x550 drivers/isdn/mISDN/timerdev.c:233 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583 x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0: mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112 do_loop_readv_writev fs/read_write.c:847 [inline] vfs_readv+0x3fb/0x690 fs/read_write.c:1020 do_readv+0xe7/0x210 fs/read_write.c:1080 __do_sys_readv fs/read_write.c:1165 [inline] __se_sys_readv fs/read_write.c:1162 [inline] __x64_sys_readv+0x45/0x50 fs/read_write.c:1162 x64_sys_call+0x2831/0x3000 arch/x86/include/generated/asm/syscalls_64.h:20 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000000 -> 0x00000001

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-23121 is a Linux kernel mISDN race condition involving timer-device work state. The public record shows a fix, but gives no CVSS score, CWE, business impact, or active exploitation evidence. Treat it as a kernel maintenance issue requiring exposure checks and vendor kernel updates, not as a confirmed emergency.

Executive priority

Handle through normal kernel patch governance unless the environment depends on mISDN or vendor guidance raises severity. The current evidence lacks exploit activity and severity scoring, but kernel defects still deserve timely remediation because impact details are incomplete.

Technical view

The issue is a lockless data race around dev->work in drivers/isdn/mISDN/timerdev.c. KCSAN observed mISDN_ioctl writing while mISDN_read read the same field; mISDN_poll is also mentioned. Stable fixes add READ_ONCE()/WRITE_ONCE() annotations across kernel branches.

Likely exposure

Exposure appears limited to Linux systems with affected kernel versions and the mISDN ISDN timer-device code present and reachable. The bundle lists affected Linux versions including 2.6.27, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, and 6.19, but package-level status requires vendor confirmation.

Exploitation context

The source bundle does not show CISA KEV listing, public exploitation, exploit availability, or a demonstrated security impact beyond a KCSAN-reported data race. Do not assume active exploitation from the available evidence.

Researcher notes

The record is narrow: it documents a race annotation fix, not a full exploitability analysis. Researchers should focus on confirming affected kernel lineage, whether timerdev paths are reachable in local deployments, and whether downstream vendors backported one of the stable commits.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable mISDN fix.
  • Prioritize systems that use or load mISDN/ISDN functionality.
  • Track distribution advisories for backported fixes and affected package versions.
  • If no vendor advisory exists, assess upgrade options against the referenced stable commits.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded systems.
  • Check whether mISDN/ISDN support is built, packaged, or loaded.
  • Confirm vendor kernel packages include the relevant stable backport.
  • Record exceptions where mISDN is absent or systems are vendor-confirmed unaffected.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23121 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1b2b03f8e514e4f68e293846ba511a948b80243c, 1b2b03f8e514e4f68e293846ba511a948b80243c, 1b2b03f8e514e4f68e293846ba511a948b80243c, 1b2b03f8e514e4f68e293846ba511a948b80243c, 1b2b03f8e514e4f68e293846ba511a948b80243c, 1b2b03f8e514e4f68e293846ba511a948b80243c, 1b2b03f8e514e4f68e293846ba511a948b80243cunaffected
LinuxLinux2.6.27, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.