CVE-2026-74370

A flaw was found in the Linux kernel's liveupdate module. This vulnerability involves a Time-of-check to Time-of-use (TOCTOU) race condition within the luo_session_retrieve() function. A concurrent thread could release and free a session after it has been looked up but before a necessary mutex lock is acquired. This could lead to unpredictable behavior or a denial of service.

Moderate severity is assigned to this flaw because successful exploitation demands local execution privileges to provoke timing conflicts during session handling, constraining the impact to a denial of service without compromising confidentiality or integrity. Furthermore, the liveupdate functionality is not present in standard Red Hat Enterprise Linux kernels, meaning shipped enterprise offerings remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.