CVE-2026-99185

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99185", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.399Z", "datePublished": "2026-10-28T10:35:43.282Z", "dateUpdated": "2026-10-31T12:44:55.216Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-31T12:44:55.216Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: core: fix race condition in split transaction handling\n\nFor a split transaction, either fw_core_handle_response() or\nsplit_transaction_timeout_callback() may manipulate the same transaction\nentry in the pending transaction list. The return value of timer_delete()\nis used to determine which function handles the entry. If the transaction\nis a split transaction and timer_delete() returns zero, the timeout\ncallback may already be running. In this case, the response handler must\nleave the entry in the list for the timeout callback to remove.\n\nA previous code refactoring broke this behavior, introducing a race\ncondition in which both functions could process the same transaction.\nThis could lead to a use-after-free on the transaction initiator side.\n\nFix the regression by ensuring that the response handler does not process\nthe transaction when timer_delete() returns zero. The timeout callback is\nresponsible for removing the entry from the pending transaction list."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - An IEEE-1394 peer supplies ACK_PENDING and a matching asynchronous response; OHCI irq_handler() queues handle_ar_packet(), which passes the attacker-chosen source/tlabel to the patched fw_core_handle_response(), requiring access to the shared FireWire bus.\nAC:L - ACK_PENDING makes transmit_complete_callback() arm split_timeout_timer, and the same peer can withhold then send the matching response at expiry, repeatedly racing timer_delete() against split_transaction_timeout_callback(); both competing events are attacker-driven.\nPR:N - fw_core_handle_response() accepts an OHCI-delivered response based only on source node ID and tlabel, while fw_device_init() automatically creates transactions for configuration-ROM reads; no credentials, capability, or authentication check gates the peer.\nUI:N - fw_node_event(FW_NODE_CREATED) schedules fw_device_init(), which calls read_config_rom() and fw_run_transaction() automatically; operating or attaching the malicious peer is the attacker's action, and no victim must open /dev/fw* or initiate I/O.\nS:U - The competing handlers corrupt fw_transaction and initiator objects inside the host kernel that owns them; no guest-host, IOMMU, sandbox, or other security-authority boundary is crossed.\nC:H - One SBP-2 completion can make complete_agent_reset_write_no_wait() free t while the competing path still reads t->packet, t->callback, and t->callback_data; reclaiming this dangling slab object gives the UAF leverage needed to read arbitrary kernel memory.\nI:H - complete_agent_reset_write_no_wait() calls kfree(t) on the first completion, while the second can double-free the object or invoke the stale t->callback after slab reuse, providing heap corruption and an indirect-call control-flow-hijack primitive.\nA:H - The duplicate completion can double-free the SBP-2 reset transaction or invoke a callback through reclaimed memory, causing SLUB corruption, an oops, or a kernel panic; the peer can retrigger the race with additional split transactions."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firewire/core-transaction.c"], "versions": [{"version": "fa2dc27100768a8a994c377051fa17a47cc66c76", "lessThan": "a8caee0e623ca5d56e829032f9ec073c09e4d224", "status": "affected", "versionType": "git"}, {"version": "fa2dc27100768a8a994c377051fa17a47cc66c76", "lessThan": "7f9f2d6abc40f79e802b4063859eda343043b85c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/firewire/core-transaction.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a8caee0e623ca5d56e829032f9ec073c09e4d224"}, {"url": "https://git.kernel.org/stable/c/7f9f2d6abc40f79e802b4063859eda343043b85c"}], "title": "firewire: core: fix race condition in split transaction handling", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/firewire/core-transaction.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a8caee0e623ca5d56e829032f9ec073c09e4d224", "status": "affected", "version": "fa2dc27100768a8a994c377051fa17a47cc66c76", "versionType": "git"}, {"lessThan": "7f9f2d6abc40f79e802b4063859eda343043b85c", "status": "affected", "version": "fa2dc27100768a8a994c377051fa17a47cc66c76", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/firewire/core-transaction.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: core: fix race condition in split transaction handling\n\nFor a split transaction, either fw_core_handle_response() or\nsplit_transaction_timeout_callback() may manipulate the same transaction\nentry in the pending transaction list. The return value of timer_delete()\nis used to determine which function handles the entry. If the transaction\nis a split transaction and timer_delete() returns zero, the timeout\ncallback may already be running. In this case, the response handler must\nleave the entry in the list for the timeout callback to remove.\n\nA previous code refactoring broke this behavior, introducing a race\ncondition in which both functions could process the same transaction.\nThis could lead to a use-after-free on the transaction initiator side.\n\nFix the regression by ensuring that the response handler does not process\nthe transaction when timer_delete() returns zero. The timeout callback is\nresponsible for removing the entry from the pending transaction list."}], "id": "CVE-2026-99185", "lastModified": "2026-10-31T13:17:59.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-28T11:17:39.377", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f9f2d6abc40f79e802b4063859eda343043b85c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8caee0e623ca5d56e829032f9ec073c09e4d224"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Use-after-free via race condition in FireWire split transaction handling", "id": "2562696", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562696"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfirewire: core: fix race condition in split transaction handling\nFor a split transaction, either fw_core_handle_response() or\nsplit_transaction_timeout_callback() may manipulate the same transaction\nentry in the pending transaction list. The return value of timer_delete()\nis used to determine which function handles the entry. If the transaction\nis a split transaction and timer_delete() returns zero, the timeout\ncallback may already be running. In this case, the response handler must\nleave the entry in the list for the timeout callback to remove.\nA previous code refactoring broke this behavior, introducing a race\ncondition in which both functions could process the same transaction.\nThis could lead to a use-after-free on the transaction initiator side.\nFix the regression by ensuring that the response handler does not process\nthe transaction when timer_delete() returns zero. The timeout callback is\nresponsible for removing the entry from the pending transaction list.", "A flaw was found in the Linux kernel's FireWire subsystem. A race condition occurs during split transaction handling when an incoming response and a timeout callback attempt to process the same transaction concurrently. An attacker could exploit this timing issue to cause a use-after-free condition, potentially leading to a denial of service (DoS) or privilege escalation."], "name": "CVE-2026-99185", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-28T10:35:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99185\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99185\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99185.mbox"], "statement": "This vulnerability is rated as having Moderate impact for Red Hat environments because successful exploitation requires local unprivileged access, specialized FireWire hardware or controller emulation, and highly precise timing to trigger the race condition. Modern enterprise deployments rarely utilize IEEE 1394 controllers, significantly constraining practical attack surface and exposure. Furthermore, older enterprise kernel branches do not contain the vulnerable transaction handling logic introduced in recent upstream refactoring.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fa2dc27100768a8a994c377051fa17a47cc66c76,a8caee0e623ca5d56e829032f9ec073c09e4d224)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fa2dc27100768a8a994c377051fa17a47cc66c76,7f9f2d6abc40f79e802b4063859eda343043b85c)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fa2dc27100768a8a994c377051fa17a47cc66c76,a8caee0e623ca5d56e829032f9ec073c09e4d224)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fa2dc27100768a8a994c377051fa17a47cc66c76,7f9f2d6abc40f79e802b4063859eda343043b85c)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:30:17.670813+00:00", "updated": "2026-11-02T04:00:09.332539+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}