---
cve: "CVE-2026-23153"
severity: "LOW"
cvss: 3.1
epss: "0.1%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-02-14 16:15:55"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-20T20:04:32+02:00"
---

# CVE-2026-23153

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

firewire: core: fix race condition against transaction list

The list of transaction is enumerated without acquiring card lock when
processing AR response event. This causes a race condition bug when
processing AT request completion event concurrently.

This commit fixes the bug by put timer start for split transaction
expiration into the scope of lock. The value of jiffies in card structure
is referred before acquiring the lock.

## Patch verfügbar (OSV)

- Kernel ≥ 6.18.9

## Referenzen

- <https://git.kernel.org/stable/c/b038874e31fc3caa0b0d5abd259dd54b918ad4a1>
- <https://git.kernel.org/stable/c/20e01bba2ae4898ce65cdcacd1bd6bec5111abd9>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-23153) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_