CVE-2026-23121

What it actually does

Data race on dev->work in mISDN timerdev allowing unsynchronized concurrent read in mISDN_read/mISDN_poll and write in mISDN_ioctl, detected via KCSAN as inconsistent 4-byte value changes.

Why it matters to the business

Potential system instability or denial of service on servers using the affected Linux kernel package, increasing operational risk for organizations relying on mISDN hardware until patched.

How an attack unfolds

An attacker with local access issues concurrent mISDN ioctl and readv calls that race on the work field; the lack of READ_ONCE/WRITE_ONCE annotations allows the value to change unexpectedly between threads, potentially triggering kernel faults or crashes.

How to fix it

Upgrade the linux-aws-5.4 package on Ubuntu Pro 18.04 LTS to version 5.4.0-1109.118~18.04.1 or later; rebuild and reboot with the updated kernel to apply READ_ONCE/WRITE_ONCE annotations.

How to confirm the fix worked

Verify the installed kernel package version matches or exceeds the fixed release; re-run KCSAN on mISDN paths or inspect timerdev.c for the added annotations; confirm no data-race warnings appear under concurrent ioctl/read workloads.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Open mISDN timer device and issue ioctl that writes to dev->work
3. Simultaneously perform readv operations that locklessly read the same field
4. Trigger the race repeatedly to induce inconsistent state or KCSAN-reported fault

How to detect it

Examine kernel logs for KCSAN data-race reports involving mISDN_ioctl and mISDN_read; search dmesg or journalctl for timerdev.c stack traces showing concurrent write/read to the work field; correlate with unexpected system reboots or oops on systems exposing mISDN devices.

What your security team should do

• Immediately schedule kernel upgrade to the fixed version on all systems using linux-aws-5.4
• Prioritize patching internet-facing or multi-user servers first due to local privilege requirement
• Monitor for kernel stability issues post-upgrade and test mISDN functionality
• Review internal use of mISDN devices and consider disabling unused ISDN modules