CVE-2026-23121: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23121 is a data race vulnerability in the Linux kernel's mISDN (ISDN subsystem) timer device driver (drivers/isdn/mISDN/timerdev.c). The flaw arises from unsynchronized concurrent access to the dev->work field between mISDN_ioctl() (write path via misdn_add_timer) and mISDN_read()/mISDN_poll() (read paths), detected by the Kernel Concurrency Sanitizer (KCSAN). It was published on February 14, 2026, and affects Linux kernel versions from 2.6.27 through multiple stable branches up to 6.18.x and 6.19-rc releases. The CVSS v3.1 base score is 5.5 (Medium) (Feedly).

The root cause is a concurrent read/write data race (CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) on the dev->work integer field in timerdev.c. When one task performs an ioctl call (e.g., mISDN_ioctl → misdn_add_timer) writing to dev->work at address 0xffff88812d848280, another task concurrently reads the same field via mISDN_read() or mISDN_poll() without any locking or atomic access guarantees. The fix adds READ_ONCE() and WRITE_ONCE() compiler annotations to enforce proper memory access ordering and prevent compiler or CPU reordering of these operations (Feedly, Kernel Patch). Exploitation requires local access with low privileges and the ability to trigger concurrent ioctl and read/poll operations on the mISDN timer device.

Successful exploitation of this data race can cause unpredictable kernel behavior, system instability, or kernel crashes, resulting in a denial of service (availability: high). There is no confidentiality or integrity impact — the vulnerability cannot be used to leak sensitive data or modify kernel state in a controlled manner. The scope is limited to the local system; lateral movement or data exfiltration are not applicable to this vulnerability (Feedly).

Upgrade the Linux kernel to a patched version: 5.10.249 or later, 5.15.199 or later, 6.1.162 or later, 6.6.122 or later, 6.12.68 or later, or 6.18.8 or later, depending on the active kernel branch. Ubuntu has issued multiple security notices addressing this CVE (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1, USN-8393-1) (Ubuntu USN-8162-1, Ubuntu USN-8180-1). As a workaround where patching is not immediately possible, restrict local user access to mISDN device files and ioctl operations, or disable the mISDN kernel module if ISDN functionality is not required (modprobe -r mISDN). Monitor kernel logs for KCSAN data-race warnings related to mISDN timerdev operations (Feedly).