Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-99185firewire: core: fix race condition in split transaction handling

Description

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same transaction entry in the pending transaction list. The return value of timer_delete() is used to determine which function handles the entry. If the transaction is a split transaction and timer_delete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove. A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side. Fix the regression by ensuring that the response handler does not process the transaction when timer_delete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.

Timeline

  1. ID reserved

    By Linux

  2. · 33 days later

    Published

  3. · 3 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-99185, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1High8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Received3.1High8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.22% · top 87% of all CVEs (15 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Affected products

  • Linux · Linux

    • affected fa2dc27100768a8a994c377051fa17a47cc66c76 – < a8caee0e623ca5d56e829032f9ec073c09e4d224
    • affected fa2dc27100768a8a994c377051fa17a47cc66c76 – < 7f9f2d6abc40f79e802b4063859eda343043b85c

  • Linux · Linux

    • affected 6.19
    • unaffected < 6.19
    • unaffected 7.2.13 – ≤ 7.2.*
    • unaffected 7.3 – ≤ *

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-99185 badge
[![CVE-2026-99185](https://cveledger.app/badge/CVE-2026-99185.svg)](https://cveledger.app/cve/CVE-2026-99185)

Record last updated .