The Linux kernel mISDN driver contains a data race involving the dev->work pointer, which can be accessed without proper synchronization in mISDN_ioctl and mISDN_read. This race may cause inconsistent updates to driver state, potentially leading to kernel memory corruption or unpredictable driver behavior. A successful exploitation would enable a local or privileged attacker to manipulate kernel data structures, with the possibility of privilege escalation or system instability.

The vulnerable code is part of the mISDN module that ships with Linux kernel releases that include the driver, specifically the 6.19 release‑candidate series from rc1 through rc6. Any system running one of these kernels with the mISDN module loaded is affected. Older stable releases that drop or patch the module are not impacted.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Exploitation requires a local process with access to the mISDN device, either via ioctl or read operations, and precise timing to trigger the race. The likely attack vector is a local privileged user controlling the mISDN device.