Live › vulnerability › CVE-2026-99185
Go to dashboardA race between the FireWire response handler and the split-transaction timeout callback lets both process the same transaction entry. The result is a use-after-free on the initiator side, which can crash the kernel or be abused for memory corruption.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Only machines running a Linux kernel with FireWire (IEEE 1394) support and the firewire-core driver loaded can hit this path. Systems without FireWire hardware or with the driver not loaded are unlikely to be exposed. Sources do not say which kernel versions are vulnerable.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
firewire: core: fix race condition in split transaction handling
For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same transaction entry in the pending transaction list. The return value of timer_delete() is used to determine which function handles the entry. If the transaction is a split transaction and timer_delete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove.
A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side.
Fix the regression by ensuring that the response handler does not process the transaction when timer_delete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.
This page as .md · .json · in your agent: get_signal("CVE-2026-99185")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.