Linux Kernel up to 7.2.8/7.3-rc4 Firewire Cdev race condition

Summaryinfo

A vulnerability marked as very critical has been reported in Linux Kernel up to 7.2.8/7.3-rc4. Impacted is an unknown function of the component Firewire Cdev. Performing a manipulation results in race condition. This vulnerability is reported as CVE-2026-98587. The attack requires a local approach. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.8/7.3-rc4. It has been classified as very critical. This affects an unknown code of the component Firewire Cdev. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for iso_resource_auto client resource The todo member of iso_resource_auto structure represents the state of the client resource and normally transitions in the following order: ISO_RES_AUTO_ALLOC -> ISO_RES_AUTO_REALLOC -> ISO_RES_AUTO_DEALLOC However, concurrent access from the work item and the file descriptor release function can cause the state to transition backwards from ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC. Prevent the back-transition by checking the current state before updating it in the work item.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-98587 since 09/25/2026. The exploitability is told to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/18/2026).

Upgrading to version 7.2.9 or 7.3-rc5 eliminates this vulnerability. Applying the patch ee1df60a0d0e8ab4b00137135733bdadd6d33dab/c6b51091cafff9ce6c03c1416aa13864d17ab97c is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.3-rc1
• 7.3-rc2
• 7.3-rc3
• 7.3-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion