A race condition exists in the Firewire core subsystem of the Linux kernel during AR response event processing. Concurrent AT request completion events can enumerate the transaction list without holding the card lock, leading to data inconsistencies. This flaw could trigger a kernel crash or other system instability, thereby affecting system availability and potentially compromising the integrity of kernel operations.

The vulnerability affects the Linux kernel's Firewire core as found in kernel releases from 6.19 RC1 through RC7 and any earlier kernels that omit the fix. Systems running these kernel versions, especially those with Firewire devices enabled, are at risk. Linux kernel maintainers and users deploying recent releases should verify whether the relevant patch is present.

With a CVSS score of 4.7 and an EPSS value below 1 percent, the risk level is considered moderate and the likelihood of exploitation low. The bug requires a precise race condition between AR and AT events, which is difficult to trigger reliably. No public exploitation vectors are documented, and the vulnerability is not listed in the CISA KEV catalog. The most plausible attack scenario would involve a local or physically connected attacker who can manipulate Firewire traffic to induce the race, but this remains an advanced threat.