CVE-2026-23121

A flaw was found in the Linux kernel's mISDN timer device. A local user with low privileges could exploit a data race condition around the dev->work flag. This can lead to incorrect wakeup logic, causing processes to block longer than expected or experience missed notifications, ultimately resulting in a Denial of Service (DoS).

A data race was reported by KCSAN in the mISDN timer device code around the dev work flag. The flag is written from the ioctl path via misdn_add_timer and it is read locklessly from the read and poll paths. In particular mISDN_read checks the flag in the wait_event_interruptible condition after dropping dev lock and mISDN_poll checks the same flag to decide whether to report EPOLLIN. Without proper annotations the compiler and CPU may reorder or optimize these accesses and readers may observe stale or inconsistent values. This can result in incorrect wakeup logic such as missed notifications spurious readiness or processes blocking longer than expected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.