In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for iso_resource_auto client resource The… (CVE-2026-98587)

The vulnerability in the Linux kernel FireWire cdev subsystem involved the iso_resource_auto structure's todo member, which tracks the client resource state. Normally, the state transitions forward through ISO_RES_AUTO_ALLOC, ISO_RES_AUTO_REALLOC, and ISO_RES_AUTO_DEALLOC. However, concurrent access between a work item and the file descriptor release function could cause a back-transition from ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC. This improper state regression was fixed by adding a check to prevent back-transition before updating the state in the work item.

The vulnerability could lead to inconsistent state management of FireWire client resources in the Linux kernel, potentially causing resource mismanagement or instability. No specific exploitation or impact details are provided in the source data.

A fix has been implemented in the Linux kernel to prevent the back-transition of the iso_resource_auto client resource state. Users should apply the official kernel update containing this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.