CVE-2026-99185

Status: UPDATED  |  Advisory ID: CVE-2026-99185

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

firewire: core: fix race condition in split transaction handling

For a split transaction, either fw_core_handle_response() or

split_transaction_timeout_callback() may manipulate the same transaction

entry in the pending transaction list. The return value of timer_delete()

is used to determine which function handles the entry. If the transaction

is a split transaction and timer_delete() returns zero, the timeout

callback may already be running. In this case, the response handler must

leave the entry in the list for the timeout callback to remove.

A previous code refactoring broke this behavior, introducing a race

condition in which both functions could process the same transaction.

This could lead to a use-after-free on the transaction initiator side.

Fix the regression by ensuring that the response handler does not process

the transaction when timer_delete() returns zero. The timeout callback is

responsible for removing the entry from the pending transaction list. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References