Race Condition Vulnerability in Linux Kernel Firewire Handling

CVE-2026-99185

What is CVE-2026-99185?

The vulnerability in the Linux kernel's firewire core handling is related to a race condition caused by improper management of split transactions. Specifically, the functions fw_core_handle_response() and split_transaction_timeout_callback() could simultaneously manipulate the same transaction entry in the pending transaction list. This occurs because a previous code refactoring disrupted the expected behavior when handling split transactions, particularly during a call to timer_delete(). If it returns zero, indicating that the timeout callback may already be running, the response handler risks processing the same transaction, potentially leading to a use-after-free error for the transaction initiator. The issue has been addressed to ensure that once timer_delete() returns zero, the response handler will not further process that transaction, allowing the timeout callback to manage the transaction entry appropriately.

References