CVE-2026-99185 firewire: core: fix race condition in split transaction handling
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99185?
CVE-2026-99185 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
firewire: core: fix race condition in split transaction handling
For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same transaction entry in the pending transaction list. The return value of timer_delete() is used to determine which function handles the entry. If the transaction is a split transaction and timer_delete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove.
A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side.
Fix the regression by ensuring that the response handler does not process the transaction when timer_delete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.
Which versions are affected by CVE-2026-99185?
How do I fix CVE-2026-99185?
Upgrade to a fixed version.
Is CVE-2026-99185 being exploited?
There is no known exploitation of CVE-2026-99185 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-99185, GHSA-xxpr-vg8x-pr7q, UBUNTU-CVE-2026-99185.