{"apiVersion":"1.0","identifier":"CVE-2026-99185","description":"In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same transaction entry in the pending transaction list. The return value of timer_delete() is used to determine which function handles the entry. If the transaction is a split transaction and timer_delete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove. A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side. Fix the regression by ensuring that the response handler does not process the transaction when timer_delete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.","publishedAt":"2026-10-28T11:17:39","lastModifiedAt":"2026-10-31T13:17:59","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99185","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00219,"riskScore":0.9,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99185","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99185","en":"https://www.redsauce.net/en/cves/CVE-2026-99185","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99185","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99185","de":"https://www.redsauce.net/de/cves/CVE-2026-99185","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99185","el":"https://www.redsauce.net/el/cves/CVE-2026-99185"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99185"}}