CVE-2026-23121: Linux Kernel Race Condition Vulnerability

CVE-2026-23121 Overview

CVE-2026-23121 is a race condition vulnerability in the Linux kernel's mISDN (modular ISDN) subsystem. The vulnerability exists in the timer device driver where the dev->work variable can be read locklessly in mISDN_read() and mISDN_poll() functions, creating a data race condition when concurrent ioctl and read operations occur. This race condition was identified by the Kernel Concurrency Sanitizer (KCSAN) tool, which detected unsynchronized access to shared memory between different CPU tasks.

Critical Impact
Concurrent unsynchronized access to the dev->work variable between mISDN_ioctl() and mISDN_read() functions can lead to unpredictable behavior, potential data corruption, or system instability on systems utilizing ISDN functionality.

Affected Products

Linux kernel with mISDN subsystem enabled
Linux kernel versions prior to the security patches
Systems using ISDN timer device functionality (drivers/isdn/mISDN/timerdev.c)

Discovery Timeline

2026-02-14 - CVE CVE-2026-23121 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23121

Vulnerability Analysis

This vulnerability represents a classic data race condition in kernel driver code. The mISDN timer device driver contains a shared variable dev->work that is accessed by multiple execution contexts without proper synchronization primitives. When one CPU core executes mISDN_ioctl() (specifically the misdn_add_timer() function), it writes to this variable. Simultaneously, another CPU core may be executing mISDN_read() which reads the same variable. Without memory barriers or locking mechanisms, the compiler and CPU may reorder these operations or cache stale values, leading to inconsistent program state.

The KCSAN tool detected this race between task 10864 on CPU 1 (writing via ioctl) and task 10857 on CPU 0 (reading via read syscall). The value was observed changing from 0x00000000 to 0x00000001 during the race, confirming the unsynchronized concurrent access.

Root Cause

The root cause is missing memory ordering annotations on the dev->work variable in the mISDN timer device driver. The variable is accessed in mISDN_read() at line 112 of timerdev.c and written in misdn_add_timer() at line 175 during ioctl operations. Without READ_ONCE() and WRITE_ONCE() annotations, the C compiler is free to perform optimizations that assume no concurrent access, and the CPU may not provide proper memory ordering guarantees between cores.

Attack Vector

The attack vector requires local access to the system with the ability to open and interact with the mISDN timer device. An attacker or malicious application would need to:

Open the mISDN timer device file descriptor
Initiate concurrent read and ioctl operations from multiple threads or processes
Exploit the timing window where the race condition occurs to cause undefined behavior

While exploitation is complex due to the precise timing requirements, the vulnerability could potentially be used to destabilize ISDN subsystem operations or create denial of service conditions on systems actively using ISDN functionality.

Detection Methods for CVE-2026-23121

Indicators of Compromise

KCSAN warnings in kernel logs indicating data races in mISDN_ioctl or mISDN_read functions
Kernel log messages referencing drivers/isdn/mISDN/timerdev.c with race condition warnings
Unexpected behavior or crashes in applications utilizing the mISDN subsystem

Detection Strategies

Enable KCSAN (Kernel Concurrency Sanitizer) during kernel compilation to detect this class of data race vulnerabilities
Monitor system logs for race condition warnings related to mISDN driver components
Use kernel debugging tools to trace concurrent access patterns to mISDN device files

Monitoring Recommendations

Implement audit logging for access to ISDN device files to detect potential exploitation attempts
Monitor for unusual patterns of concurrent ioctl and read operations on mISDN devices
Deploy kernel integrity monitoring solutions to detect any tampering with driver code

How to Mitigate CVE-2026-23121

Immediate Actions Required

Apply the latest kernel security patches from the official kernel.org repositories
If ISDN functionality is not required, disable or unload the mISDN kernel modules
Restrict access to ISDN device files to trusted users and applications only
Update to a patched kernel version that includes the READ_ONCE()/WRITE_ONCE() annotations

Patch Information

The fix involves adding proper memory ordering annotations using READ_ONCE() for reads and WRITE_ONCE() for writes to the dev->work variable. Multiple stable kernel branches have received patches addressing this vulnerability:

Workarounds

Disable the mISDN kernel module if ISDN functionality is not required: modprobe -r mISDN_core
Restrict device file permissions to prevent unprivileged access to mISDN timer devices
Implement application-level serialization if concurrent access to ISDN devices is necessary

bash

# Configuration example
# Disable mISDN module loading
echo "blacklist mISDN_core" >> /etc/modprobe.d/blacklist-misdn.conf
echo "blacklist mISDNipac" >> /etc/modprobe.d/blacklist-misdn.conf

# Remove currently loaded mISDN modules
modprobe -r mISDN_core 2>/dev/null || true

# Restrict access to ISDN devices (if module must remain loaded)
chmod 600 /dev/mISDN*