CVE-2026-99185: Use After Free

In the Linux kernel, the following vulnerability has been resolved:

firewire: core: fix race condition in split transaction handling

For a split transaction, either fwcorehandleresponse() or splittransactiontimeoutcallback() may manipulate the same transaction entry in the pending transaction list. The return value of timerdelete() is used to determine which function handles the entry. If the transaction is a split transaction and timerdelete() returns zero, the timeout callback may already be running. In this case, the response handler must leave the entry in the list for the timeout callback to remove.

A previous code refactoring broke this behavior, introducing a race condition in which both functions could process the same transaction. This could lead to a use-after-free on the transaction initiator side.

Fix the regression by ensuring that the response handler does not process the transaction when timerdelete() returns zero. The timeout callback is responsible for removing the entry from the pending transaction list.