Live › vulnerability › CVE-2026-98587
Go to dashboardA race between the FireWire character device work item and file descriptor release lets the iso_resource_auto client resource state move backward from deallocation to reallocation. The sources describe only the state-machine race and its fix, not a demonstrated code execution or data exposure path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
firewire: cdev: fix back-transition for iso_resource_auto client resource
The todo member of iso_resource_auto structure represents the state of the client resource and normally transitions in the following order:
ISO_RES_AUTO_ALLOC -> ISO_RES_AUTO_REALLOC -> ISO_RES_AUTO_DEALLOC
However, concurrent access from the work item and the file descriptor release function can cause the state to transition backwards from ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC.
Prevent the back-transition by checking the current state before updating it in the work item.
This page as .md · .json · in your agent: get_signal("CVE-2026-98587")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.