{"id":"CVE-2026-98587","kind":"vulnerability","aliases":["CVE-2026-98587"],"related":[],"title":"Linux kernel: FireWire cdev race can move an isochronous resource backward","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: cdev: fix back-transition for iso_resource_auto client resource\n\nThe todo member of iso_resource_auto structure represents the state of the\nclient resource and normally transitions in the following order:\n\n    ISO_RES_AUTO_ALLOC -> ISO_RES_AUTO_REALLOC -> ISO_RES_AUTO_DEALLOC\n\nHowever, concurrent access from the work item and the file descriptor\nrelease function can cause the state to transition backwards from\nISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC.\n\nPrevent the back-transition by checking the current state before\nupdating it in the work item.","summary":"A race between the FireWire character device work item and file descriptor release lets the iso_resource_auto client resource state move backward from deallocation to reallocation. The sources describe only the state-machine race and its fix, not a demonstrated code execution or data exposure path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewire","infrastructure","linux-kernel"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:11+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:22:57+00:00","updated_at":"2026-10-25T05:22:57+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:22:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: FireWire cdev race can move an isochronous resource backward","impact":"low","summary":"A race between the FireWire character device work item and file descriptor release lets the iso_resource_auto client resource state move backward from deallocation to reallocation. The sources describe only the state-machine race and its fix, not a demonstrated code execution or data exposure path.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","firewire"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources describe a state race only","analyst_note":"Check the kernel stable commit and NVD page for the affected kernel version ranges and whether the race has a demonstrated security impact beyond a state inconsistency.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000523,"input_tokens":3452,"output_tokens":356,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98587':14A,17A 'access':129C 'alloc':118C 'auto':40B,90C,99C,117C,121C,125C,150C,155C 'back':85C,160C 'back-transit':84C,159C 'backward':11A,45B,146C 'caus':141C 'cdev':4A,82C 'charact':28B 'check':163C 'client':41B,91C,106C 'code':65B 'concurr':128C 'current':165C 'cve':12A,15A 'data':68B 'dealloc':47B,126C,151C 'demonstr':64B 'describ':52B 'descriptor':34B,137C 'devic':29B 'execut':66B 'exposur':69B 'file':33B,136C 'firewir':3A,18B,27B,81C 'fix':61B,83C 'follow':76C,113C 'function':139C 'howev':127C 'infrastructur':19B 'iso':38B,88C,97C,115C,119C,123C,148C,153C 'isochron':9A 'item':31B,133C,173C 'kernel':2A,22B,74C 'let':36B 'linux':1A,21B,73C 'linux-kernel':20B 'machin':57B 'member':95C 'move':7A,44B 'normal':109C 'order':114C 'path':70B 'prevent':157C 'race':5A,24B,58B 'realloc':49B,122C,156C 'releas':35B,138C 'repres':101C 'res':116C,120C,124C,149C,154C 'resolv':80C 'resourc':10A,39B,42B,89C,92C,98C,107C 'sourc':51B 'state':43B,56B,103C,143C,166C 'state-machin':55B 'structur':100C 'todo':94C 'transit':86C,110C,145C,161C 'updat':168C 'vulner':77C 'work':30B,132C,172C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98587","severity":null,"published_at":"2026-10-18T16:17:11+00:00","modified_at":"2026-10-19T10:19:19+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}