Executive brief
The Linux kernel's liveupdate subsystem contains a logic error in how it handles failed file retrieval operations from File-Lifecycle-Bound (FLB) modules. When a retrieval attempt fails, the kernel was not recording this failure, causing subsequent retry attempts to repeat the operation on an inconsistent system state, potentially leading to memory corruption or system instability.
Technical details
This is a logic bug in the kernel/liveupdate/luo_flb.c liveupdate retrieval handler. The vulnerability exists in the luo_flb_retrieve_one() function, which manages FLB retrieve() callback invocations. When retrieve() fails, the error code was returned immediately without storing the failure state. A subsequent attempt to retrieve another file from the same FLB would trigger another retrieve() call on an FLB in an undefined state (with freed KHO pages and deserialized data structures already cleaned up), violating the preconditions expected by the retrieve logic. The fix changes the 'retrieved' boolean field to 'retrieve_status' integer, allowing the function to cache both success (positive value) and failure (negative value) states. The attack vector requires local code execution within the kernel's liveupdate context; no remote exploitation is possible. Patches are available in commit 5c4a03afcb21783987ffc64562b76ddd5a21b12b and backported to stable kernels.
Affected products
- Linux Linux kernel affected versions prior to fix commit 5c4a03afcb21783987ffc64562b76ddd5a21b12b
Timeline
- 2026-09-17: disclosed: CVE-2026-92483 published
- 2026-05-28: patched: Fix commit 5c4a03afcb21783987ffc64562b76ddd5a21b12b authored
- 2026-07-25: patched: Fix merged to master branch
- 2026-09-14: patched: Fix backported to stable kernels