CVE-2026-74369: Linux kernel · liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 26 Oct 2026, 13:47 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 17 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
A fix has been implemented in the Linux kernel to reorder module_put() and xa_erase() calls to prevent the use-after-free condition. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation.
Description
In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() In luo_file_unpreserve_files() and luo_file_finish(), reorder module_put() and xa_erase() to ensure the file handler module remains pinned while its operations are being accessed. Specifically, luo_get_id() dereferences fh->ops->get_id, so the module reference must be held until after xa_erase() (which calls luo_get_id) completes. For luo_file_finish(), this requires moving the module_put() call out of the luo_file_finish_one() helper and into the main loop of luo_file_finish() itself.
References
- nvd.nist.gov/vuln/detail/CVE-2026-74369 (opens in a new tab)
- git.kernel.org/stable/c/291dcd37c8c8f8f8e1bccc92228f44bf371762a8 (opens in a new tab)
- git.kernel.org/stable/c/f7fca3db635022429382cf26e5b08b33558e375d (opens in a new tab)
- ubuntu.com/security/CVE-2026-74369 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-74369 (opens in a new tab)
- git.kernel.org/linus/291dcd37c8c8f8f8e1bccc92228f44bf371762a8 (opens in a new tab)