Executive brief
The Linux kernel's liveupdate feature contains a use-after-free vulnerability in file handler cleanup functions. When reordering operations during file preservation and finalization, module references could be released before the code accessing them completes, potentially causing a crash or system instability during live update operations.
Technical details
A use-after-free vulnerability exists in the liveupdate subsystem's luo_file_unpreserve_files() and luo_file_finish() functions in kernel/liveupdate/luo_file.c. The vulnerable code was calling module_put() before xa_erase(), which internally invokes luo_get_id() to dereference fh->ops->get_id. By releasing the module reference before xa_erase() completes, freed memory could be accessed. The fix reorders these operations to ensure the module remains pinned (reference held) until after xa_erase() and its internal luo_get_id() call complete. This is a code logic error requiring operation reordering rather than a cryptographic or memory corruption flaw. The vulnerability affects the kernel's live update functionality on systems using liveupdate features.
Affected products
- Linux Linux kernel Multiple versions (liveupdate feature)
Timeline
- 2026-08-15: disclosed
- 2026-05-27: patched: Fix committed upstream