CVE-2026-99185

In the Linux kernel, the following vulnerability has been resolved:

firewire: core: fix race condition in split transaction handling

For a split transaction, either fw core handle response() or split transaction timeout callback() may manipulate the same transaction entry in the pending transaction list. The return value of timer delete() is used to determine which function handles the entry. If the transaction is a split transaction and timer delete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove.

A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side.

Fix the regression by ensuring that the response handler does not process the transaction when timer delete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.