---
id: CVE-2026-99185
title: 'firewire: core: fix race condition in split transaction handling'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  firewire: core: fix race condition in split transaction handling

  For a split transaction, either fw_core_handle_response() or
  split_transaction_timeout_callback() may …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fa2dc27100768a8a994c377051fa17a47cc66c76 <
    a8caee0e623ca5d56e829032f9ec073c09e4d224
  - >-
    Linux >= fa2dc27100768a8a994c377051fa17a47cc66c76 <
    7f9f2d6abc40f79e802b4063859eda343043b85c
  - Linux 6.19
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:43.282Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99185'
references:
  - url: 'https://git.kernel.org/stable/c/a8caee0e623ca5d56e829032f9ec073c09e4d224'
  - url: 'https://git.kernel.org/stable/c/7f9f2d6abc40f79e802b4063859eda343043b85c'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.377Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

firewire: core: fix race condition in split transaction handling

For a split transaction, either fw_core_handle_response() or
split_transaction_timeout_callback() may manipulate the same transaction
entry in the pending transaction list. The return value of timer_delete()
is used to determine which function handles the entry. If the transaction
is a split transaction and timer_delete() returns zero, the timeout
callback may already be running. In this case, the response handler must
leave the entry in the list for the timeout callback to remove.

A previous code refactoring broke this behavior, introducing a race
condition in which both functions could process the same transaction.
This could lead to a use-after-free on the transaction initiator side.

Fix the regression by ensuring that the response handler does not process
the transaction when timer_delete() returns zero. The timeout callback is
responsible for removing the entry from the pending transaction list.

## Affected

- `Linux >= fa2dc27100768a8a994c377051fa17a47cc66c76 < a8caee0e623ca5d56e829032f9ec073c09e4d224`
- `Linux >= fa2dc27100768a8a994c377051fa17a47cc66c76 < 7f9f2d6abc40f79e802b4063859eda343043b85c`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.