CVE-2026-98587

A flaw was found in the Linux kernel's FireWire subsystem. A local user can trigger a race condition by concurrently releasing a device file descriptor while an asynchronous resource management task is running. This flaw allows a resource state to transition backwards from deallocation to reallocation, leading to inconsistent internal states and a potential Denial of Service (DoS) through a system crash.

This vulnerability is rated as having Moderate impact because exploitation requires local access, specific timing to win a race condition, and physical or virtual FireWire hardware that is rarely present in standard enterprise server environments. While an unprivileged local user could potentially cause a denial of service through a kernel crash, the issue does not permit arbitrary code execution or privilege escalation. Furthermore, default Red Hat Enterprise Linux installations do not load the FireWire subsystem unless matching hardware controllers are detected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.