---
id: CVE-2026-98587
title: 'firewire: cdev: fix back-transition for iso_resource_auto client resource'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  firewire: cdev: fix back-transition for iso_resource_auto client resource

  The todo member of iso_resource_auto structure represents the state of the
  client resource an…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fcabbf40fae501379b4f3a057febe92d4b0ebdd8 <
    ee1df60a0d0e8ab4b00137135733bdadd6d33dab
  - >-
    Linux >= fcabbf40fae501379b4f3a057febe92d4b0ebdd8 <
    c6b51091cafff9ce6c03c1416aa13864d17ab97c
  - Linux 7.2
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:19:00.077Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98587'
references:
  - url: 'https://git.kernel.org/stable/c/ee1df60a0d0e8ab4b00137135733bdadd6d33dab'
  - url: 'https://git.kernel.org/stable/c/c6b51091cafff9ce6c03c1416aa13864d17ab97c'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.251Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

firewire: cdev: fix back-transition for iso_resource_auto client resource

The todo member of iso_resource_auto structure represents the state of the
client resource and normally transitions in the following order:

    ISO_RES_AUTO_ALLOC -> ISO_RES_AUTO_REALLOC -> ISO_RES_AUTO_DEALLOC

However, concurrent access from the work item and the file descriptor
release function can cause the state to transition backwards from
ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC.

Prevent the back-transition by checking the current state before
updating it in the work item.

## Affected

- `Linux >= fcabbf40fae501379b4f3a057febe92d4b0ebdd8 < ee1df60a0d0e8ab4b00137135733bdadd6d33dab`
- `Linux >= fcabbf40fae501379b4f3a057febe92d4b0ebdd8 < c6b51091cafff9ce6c03c1416aa13864d17ab97c`
- `Linux 7.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.