Linux kernel: Use-after-free from race condition in FireWire split transactions
Summary
A race condition in the Linux kernel FireWire core (drivers/firewire) lets the response handler and the split-transaction timeout callback process the same pending transaction. This can cause a use-after-free on the transaction initiator side. The flaw is a local kernel code path and only matters on systems where the FireWire stack is loaded and reachable; the maintainers consider it unlikely to occur in practice.
Affected
- Linux kernel 6.19 and later, before the fixed stable releases (per CNA record and OSV: introduced in 6.19.0)
- Sources disagree on the exact range; the CNA record also names commit fa2dc27100768a8a994c377051fa17a47cc66c76 as the start of the affected range
- Distribution kernels may be affected; Ubuntu lists the status as Needs evaluation at the time of research
Fixed in
- Linux kernel 7.2.13 (per OSV)
- Stable commits a8caee0e623ca5d56e829032f9ec073c09e4d224 and 7f9f2d6abc40f79e802b4063859eda343043b85c
- Check your distribution's advisory for the exact fixed kernel build
Workaround
- No vendor-documented workaround; the fix is the kernel patch
- Suggestion, not from a source: if no FireWire hardware is used, blacklist or unload the firewire_ohci and firewire_core modules, and disable FireWire in BIOS/UEFI where possible (confirm module names on your system first)
Exploitation
- Not in CISA KEV; no source reports exploitation
- No public proof-of-concept found at the time of research
- The maintainer's pull request states the issue is unlikely to occur in practice
Our recommendation
- Install the fixed kernel from your distribution as part of normal kernel maintenance
- Check for FireWire hardware with lspci or dmesg; prioritise systems with FireWire hardware, such as audio or video workstations
- On systems without FireWire use, blacklist or unload the FireWire modules
- Recheck exploitation status later, as the CVSS score of 8.8 and EPSS value could not be verified
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 7f9f2d6abc40f79e802b4063859eda343043b85c git.kernel.org
- Linux stable commit a8caee0e623ca5d56e829032f9ec073c09e4d224 git.kernel.org
- Ubuntu CVE tracker CVE-2026-99185 ubuntu.com
- OffSeq radar CVE-2026-99185 radar.offseq.com
- Maintainer pull request commit (Toradex mirror) git.toradex.cn
- Threatint CVE-2026-99185 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 14:22.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same transaction entry in the pending transaction list. The return value of timer_delete() is used to determine which function handles the entry. If the transaction is a split transaction and timer_delete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove. A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side. Fix the regression by ensuring that the response handler does not process the transaction when timer_delete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.