CVE-2026-74369

A flaw was found in the Linux kernel's liveupdate component. This use-after-free vulnerability occurs due to an incorrect order of operations when managing file handler modules. Specifically, the system attempts to access module operations after the module's reference count has been decremented, leading to the use of freed memory. A local attacker could exploit this to cause system instability or potentially execute arbitrary code.

A moderate-impact use-after-free flaw was found in the Linux kernel's liveupdate (LUO) subsystem, which is not included in the kernels that Red Hat ships. In luo_file_unpreserve_files() and luo_file_finish(), module_put() released the file handler module's reference before xa_erase() completed, even though luo_get_id() still dereferences fh->ops->get_id from that module's operations, so the module could be freed while its operations were still being accessed. A local attacker able to trigger the liveupdate file unpreserve/finish paths could exploit this use-after-free to crash the kernel and, in the worst case, execute arbitrary code in kernel context. Red Hat rates this flaw Moderate severity (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting the local attack requirements and primarily availability impact. The vulnerable code was introduced upstream in the 7.1 kernel release cycle and is not present in the kernels shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (including the kernel-rt variant) or in Red Hat In-Vehicle OS; consequently, all Red Hat products listed on this flaw are marked not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.