CVE-2026-99185

A flaw was found in the Linux kernel's FireWire subsystem. A race condition occurs during split transaction handling when an incoming response and a timeout callback attempt to process the same transaction concurrently. An attacker could exploit this timing issue to cause a use-after-free condition, potentially leading to a denial of service (DoS) or privilege escalation.

This vulnerability is rated as having Moderate impact for Red Hat environments because successful exploitation requires local unprivileged access, specialized FireWire hardware or controller emulation, and highly precise timing to trigger the race condition. Modern enterprise deployments rarely utilize IEEE 1394 controllers, significantly constraining practical attack surface and exposure. Furthermore, older enterprise kernel branches do not contain the vulnerable transaction handling logic introduced in recent upstream refactoring.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.