Linux Kernel Firewire Core Race Condition in Split Tx Handling
CVE-2026-99185 Published on October 28, 2026
firewire: core: fix race condition in split transaction handling
In the Linux kernel, the following vulnerability has been resolved:
firewire: core: fix race condition in split transaction handling
For a split transaction, either fw_core_handle_response() or
split_transaction_timeout_callback() may manipulate the same transaction
entry in the pending transaction list. The return value of timer_delete()
is used to determine which function handles the entry. If the transaction
is a split transaction and timer_delete() returns zero, the timeout
callback may already be running. In this case, the response handler must
leave the entry in the list for the timeout callback to remove.
A previous code refactoring broke this behavior, introducing a race
condition in which both functions could process the same transaction.
This could lead to a use-after-free on the transaction initiator side.
Fix the regression by ensuring that the response handler does not process
the transaction when timer_delete() returns zero. The timeout callback is
responsible for removing the entry from the pending transaction list.
Products Associated with CVE-2026-99185
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version fa2dc27100768a8a994c377051fa17a47cc66c76 and below a8caee0e623ca5d56e829032f9ec073c09e4d224 is affected.
- Version fa2dc27100768a8a994c377051fa17a47cc66c76 and below 7f9f2d6abc40f79e802b4063859eda343043b85c is affected.
- Version 6.19 is affected.
- Before 6.19 is unaffected.
- Version 7.2.13, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.