AEGLIX vulnerability intelligence
CVE-2026-99185
UNSCORED · Received
Published: 2026-10-28 · Updated: 2026-10-28 · Source: NVD
Stored catalog record
Source record retrieved 2026-10-28T11:20:37.101769+00:00. Scheduled imports handle updates; this page does not assert that the provider was queried just now.
Vulnerability overview
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fw_core_handle_response() or split_transaction_timeout_callback() may manipulate the same transaction entry in the pending transaction list. The return value of timer_delete() is used to determine which function handles the entry. If the transaction is a split transaction and timer_delete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove. A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side. Fix the regression by ensuring that the response handler does not process the transaction when timer_delete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.
Patch review priority
Assess exposure and vendor guidance
- No higher-priority signal is available in the current stored evidence.
- Fresh EPSS data is unavailable; missing values are not zero.
EPSS unavailable; no zero score is assumed.
EPSS estimates probability of exploitation in the next 30 days. It does not measure your exposure or prove exploitation. The elevated threshold is 10%; CISA KEV takes precedence. About FIRST EPSS ↗
Severity and scoring
- CVSS score
- Not scored · UNSCORED
- CVSS version
- Not supplied
- CVSS vector
- Not supplied
- Weaknesses
- Not supplied
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Not listed in the CISA catalog retrieved for this record. This does not establish that exploitation has not occurred.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
NVD has not supplied affected-version configurations for this record. Check the vendor references below.