The vulnerability is a data race in the Linux kernel’s mISDN driver, where the dev->work pointer can be read without proper synchronization in functions such as mISDN_ioctl and mISDN_read. This race can cause inconsistent updates to driver state, potentially leading to memory corruption or unstable behavior of the driver. The CVE description indicates that unsafe concurrent access was identified, and the fixed code adds READ_ONCE/WRITE_ONCE annotations to prevent the race. This issue is classified as CWE-362: Race Condition.

The affected code is part of the mISDN kernel module that ships with Linux kernel releases that include the driver. The Common Platform Enumeration (CPE) strings show that kernels 6.19 release‑candidate 1 through 6 are affected, specifically the 6.19 rc1 through rc6 revisions. Systems running any of those kernel versions with the mISDN module loaded are vulnerable. Older stable releases that exclude or patch the module are not impacted.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local process with access to the mISDN device, either via ioctl or read operations, and precise timing to trigger the race. The likely attack vector is a local privileged user or a local process with elevated privileges controlling the mISDN device; this inference is based on the requirement for direct interaction with the mISDN device.