{"id":"CVE-2026-99185","kind":"vulnerability","aliases":["CVE-2026-99185"],"related":[],"title":"Linux kernel FireWire: race condition causes use-after-free in transactions","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: core: fix race condition in split transaction handling\n\nFor a split transaction, either fw_core_handle_response() or\nsplit_transaction_timeout_callback() may manipulate the same transaction\nentry in the pending transaction list. The return value of timer_delete()\nis used to determine which function handles the entry. If the transaction\nis a split transaction and timer_delete() returns zero, the timeout\ncallback may already be running. In this case, the response handler must\nleave the entry in the list for the timeout callback to remove.\n\nA previous code refactoring broke this behavior, introducing a race\ncondition in which both functions could process the same transaction.\nThis could lead to a use-after-free on the transaction initiator side.\n\nFix the regression by ensuring that the response handler does not process\nthe transaction when timer_delete() returns zero. The timeout callback is\nresponsible for removing the entry from the pending transaction list.","summary":"A race between the FireWire response handler and the split-transaction timeout callback lets both process the same transaction entry. The result is a use-after-free on the initiator side, which can crash the kernel or be abused for memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewire","linux-kernel","runtime","self-hosted"],"not_affected_if":["firewire-driver-not-loaded","no-firewire-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit fixing the firewire split transaction race (the fix ensures the response handler skips entries when timer_delete() returns zero).","status":"open","published_at":"2026-10-28T11:17:39+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:35:19+00:00","updated_at":"2026-10-28T11:35:19+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T11:35:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit fixing the firewire split transaction race (the fix ensures the response handler skips entries when timer_delete() returns zero).","reach":"local","title":"Linux kernel FireWire: race condition causes use-after-free in transactions","impact":"high","summary":"A race between the FireWire response handler and the split-transaction timeout callback lets both process the same transaction entry. The result is a use-after-free on the initiator side, which can crash the kernel or be abused for memory corruption.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","firewire","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local use-after-free in kernel memory could lead to crash or code execution","analyst_note":"Check the NVD entry and the upstream kernel.org commit for affected and fixed kernel versions, and whether an attacker needs local access to trigger it.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-firewire-hardware","firewire-driver-not-loaded"],"who_is_affected":"Only machines running a Linux kernel with FireWire (IEEE 1394) support and the firewire-core driver loaded can hit this path. Systems without FireWire hardware or with the driver not loaded are unlikely to be exposed. Sources do not say which kernel versions are vulnerable.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000615,"input_tokens":3516,"output_tokens":526,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99185':15A,18A 'abus':67B 'alreadi':146C 'behavior':174C 'broke':172C 'callback':40B,103C,144C,165C,223C 'case':151C 'caus':6A 'code':170C 'condit':5A,85C,178C 'core':82C,96C 'corrupt':70B 'could':183C,189C 'crash':62B 'cve':13A,16A 'delet':120C,139C,218C 'determin':124C 'either':94C 'ensur':206C 'entri':47B,109C,129C,158C,229C 'firewir':3A,19B,31B,81C 'fix':83C,202C 'follow':76C 'free':10A,55B,196C 'function':126C,182C 'fw':95C 'handl':89C,97C,127C 'handler':33B,154C,210C 'host':26B 'initi':58B,200C 'introduc':175C 'kernel':2A,22B,64B,74C 'lead':190C 'leav':156C 'let':41B 'linux':1A,21B,73C 'linux-kernel':20B 'list':114C,161C,234C 'manipul':105C 'may':104C,145C 'memori':69B 'must':155C 'pend':112C,232C 'previous':169C 'process':43B,184C,213C 'race':4A,28B,84C,177C 'refactor':171C 'regress':204C 'remov':167C,227C 'resolv':80C 'respons':32B,98C,153C,209C,225C 'result':49B 'return':116C,140C,219C 'run':148C 'runtim':23B 'self':25B 'self-host':24B 'side':59B,201C 'split':37B,87C,92C,100C,135C 'split-transact':36B 'timeout':39B,102C,143C,164C,222C 'timer':119C,138C,217C 'transact':12A,38B,46B,88C,93C,101C,108C,113C,132C,136C,187C,199C,215C,233C 'use':8A,53B,122C,194C 'use-after-fre':7A,52B,193C 'valu':117C 'vulner':77C 'zero':141C,220C","nicknames":[],"mitigations":[],"who_affected":"Only machines running a Linux kernel with FireWire (IEEE 1394) support and the firewire-core driver loaded can hit this path. Systems without FireWire hardware or with the driver not loaded are unlikely to be exposed. Sources do not say which kernel versions are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99185","severity":null,"published_at":"2026-10-28T11:17:39+00:00","modified_at":"2026-10-28T11:17:39+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}