CVE-2026-98587
Received Received - Intake

Race Condition in Linux Kernel Firewire CDEV

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for iso_resource_auto client resource The todo member of iso_resource_auto structure represents the state of the client resource and normally transitions in the following order: ISO_RES_AUTO_ALLOC -> ISO_RES_AUTO_REALLOC -> ISO_RES_AUTO_DEALLOC However, concurrent access from the work item and the file descriptor release function can cause the state to transition backwards from ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC. Prevent the back-transition by checking the current state before updating it in the work item.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98587
EUVD
EUVD-2026-103632

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux fcabbf40fae501379b4f3a057febe92d4b0ebdd8
Linux Linux fcabbf40fae501379b4f3a057febe92d4b0ebdd8
Linux Linux 7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the firewire subsystem. It involves a state transition issue in the iso_resource_auto structure where concurrent access can cause the resource state to move backward from ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC, which should not happen under normal operation.

Detection Guidance

This vulnerability is specific to the Linux kernel's firewire subsystem and does not have direct network or remote detection methods. Detection involves checking kernel logs for firewire-related errors or verifying the kernel version against patched releases. Use commands like 'dmesg | grep firewire' or 'uname -r' to inspect the kernel version.

Impact Analysis

This vulnerability could lead to improper handling of firewire resources, potentially causing system instability or unexpected behavior in firewire device operations. Users relying on firewire devices may experience crashes or resource leaks.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If immediate updates are unavailable, consider disabling the firewire subsystem via kernel module blacklisting or restricting access to firewire devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart