Executive brief
The Linux kernel's live update feature handles system updates without rebooting. A reference counting bug in the File-Lifecycle-Bound (FLB) data handling could allow freed memory to be accessed after a live update operation completes, potentially leading to memory corruption or system instability.
Technical details
This fix addresses a use-after-free vulnerability in the liveupdate subsystem's FLB (File-Lifecycle-Bound) data management. The root cause is missing reference count increment in liveupdate_flb_get_incoming(), which fails to protect the FLB structure from being freed while a caller is actively using it. During a live update, subsystems may need to hold FLB data for extended periods (e.g., during device enumeration). Without proper reference counting, the FLB structure could be prematurely freed, leading to use-after-free memory access. The fix increments the refcount in liveupdate_flb_get_incoming() and introduces liveupdate_flb_put_incoming() to allow callers to explicitly release the reference. This is a local kernel-level vulnerability with no network attack vector.
Affected products
- Linux Linux Kernel all versions (patch available in mainline and stable series)
Timeline
- 2026-04-23: disclosed: Patch authored by David Matlack
- 2026-06-01: patched: Merged to mainline (commit d8e47bd)
- 2026-07-24: patched: Backported to stable branches (commit 725ada0)