CVE-2026-23153
published 2026-02-14CVE-2026-23153: In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition against transaction list The list of transaction is…
PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.07%
0.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
firewire: core: fix race condition against transaction list
The list of transaction is enumerated without acquiring card lock when
processing AR response event. This causes a race condition bug when
processing AT request completion event concurrently.
This commit fixes the bug by put timer start for split transaction
expiration into the scope of lock. The value of jiffies in card structure
is referred before acquiring the lock.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.18.9-1 (forky) | linux 6.18.9-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= b5725cfa4120a4d234ab112aad151d731531d093 < b038874e31fc3caa0b0d5abd259dd54b918ad4a1 | b038874e31fc3caa0b0d5abd259dd54b918ad4a1 |
| linux | linux | >= b5725cfa4120a4d234ab112aad151d731531d093 < 20e01bba2ae4898ce65cdcacd1bd6bec5111abd9 | 20e01bba2ae4898ce65cdcacd1bd6bec5111abd9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.18.9-1 | 6.18.9-1 |
| linux | linux_kernel | >= 6.18 < 6.18.9 | 6.18.9 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7LOW
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: firewire: core: fix race condition against transaction list
vendor_redhat·2026-02-14·CVSS 4.7
CVE-2026-23153 [MEDIUM] CWE-366 kernel: firewire: core: fix race condition against transaction list
kernel: firewire: core: fix race condition against transaction list
In the Linux kernel, the following vulnerability has been resolved:
firewire: core: fix race condition against transaction list
The list of transaction is enumerated without acquiring card lock when
processing AR response event. This causes a race condition bug when
processing AT request completion event concurrently.
This commit fixes the bug by put timer start for split transaction
expiration into the scope of lock. The value of jiffies in card structure
is referred before acquiring the lock.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise
Debian
CVE-2026-23153: linux - In the Linux kernel, the following vulnerability has been resolved: firewire: c...
vendor_debian·2026·CVSS 4.7
CVE-2026-23153 [MEDIUM] CVE-2026-23153: linux - In the Linux kernel, the following vulnerability has been resolved: firewire: c...
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition against transaction list The list of transaction is enumerated without acquiring card lock when processing AR response event. This causes a race condition bug when processing AT request completion event concurrently. This commit fixes the bug by put timer start for split transaction expiration into the scope of lock. The value of jiffies in card structure is referred before acquiring the lock.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.18.9-1)
sid: resolved (fixed in 6.18.9-1)
trixie: resolved
VulDB
Linux Kernel up to 6.18.8 firewire race condition (Nessus ID 299316 / WID-SEC-2026-0421)
vuldb·2026-08-08·CVSS 4.7
CVE-2026-23153 [MEDIUM] Linux Kernel up to 6.18.8 firewire race condition (Nessus ID 299316 / WID-SEC-2026-0421)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.18.8. Affected by this issue is some unknown functionality of the component firewire. Executing a manipulation can lead to race condition.
This vulnerability is handled as CVE-2026-23153. The attack can only be done within the local network. There is not any exploit available.
The affected component should be upgraded.
GHSA
GHSA-7q43-7j7f-g59m: In the Linux kernel, the following vulnerability has been resolved:
firewire: core: fix race condition against transaction list
The list of transact
ghsa_unreviewed·2026-02-14
CVE-2026-23153 [MEDIUM] CWE-362 GHSA-7q43-7j7f-g59m: In the Linux kernel, the following vulnerability has been resolved:
firewire: core: fix race condition against transaction list
The list of transact
In the Linux kernel, the following vulnerability has been resolved:
firewire: core: fix race condition against transaction list
The list of transaction is enumerated without acquiring card lock when
processing AR response event. This causes a race condition bug when
processing AT request completion event concurrently.
This commit fixes the bug by put timer start for split transaction
expiration into the scope of lock. The value of jiffies in card structure
is referred before acquiring the lock.
OSV
CVE-2026-23153: In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition against transaction list The list of transactio
osv·2026-02-14·CVSS 4.7
CVE-2026-23153 [MEDIUM] CVE-2026-23153: In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition against transaction list The list of transactio
In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition against transaction list The list of transaction is enumerated without acquiring card lock when processing AR response event. This causes a race condition bug when processing AT request completion event concurrently. This commit fixes the bug by put timer start for split transaction expiration into the scope of lock. The value of jiffies in card structure is referred before acquiring the lock.
No detection rules found.
No public exploits indexed.
2026-02-14
Published