PT-2026-8148 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-02-14 · CVE-2026-23153

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the FireWire core when enumerating the transaction list without acquiring the card lock during the processing of an AR response event. This can occur concurrently with the processing of an AT request completion event. The issue is addressed by placing the timer start for split transaction expiration within the scope of the lock, and referencing the jiffies value in the card structure before acquiring the lock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-23153

Affected Products

Linux Kernel

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23153.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23153 · Vendor Advisory
• https://git.kernel.org/stable/c/20e01bba2ae4898ce65cdcacd1bd6bec5111abd9 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-23153 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23153 · Security Note
• https://git.kernel.org/stable/c/b038874e31fc3caa0b0d5abd259dd54b918ad4a1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23153 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23153 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23153 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23153 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/linus/20e01bba2ae4898ce65cdcacd1bd6bec5111abd9 · Note
• https://twitter.com/CVEnew/status/2022708981668401619 · Twitter Post