Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() In… (CVE-2026-74369)
In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() In luo_file_unpreserve_files() and luo_file_finish(), reorder module_put() and xa_erase() to ensure the file handler module remains pinned while its operations are being accessed. Specifically, luo_get_id() dereferences fh->ops->get_id, so the module reference must be held until after xa_erase() (which calls luo_get_id) completes. For luo_file_finish(), this requires moving the module_put() call out of the luo_file_finish_one() helper and into the main loop of luo_file_finish() itself.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel liveupdate feature involved a use-after-free condition in the functions luo_file_unpreserve_files() and luo_file_finish(). The issue was caused by calling module_put() before xa_erase(), which leads to the file handler module being released prematurely while its operations were still accessed, specifically during a call to luo_get_id(). The fix reordered these calls to keep the module reference held until after xa_erase() completes, preventing the use-after-free scenario.
Potential Impact
This vulnerability could allow kernel memory corruption due to use-after-free, potentially leading to system instability or privilege escalation if exploited. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to reorder module_put() and xa_erase() calls to prevent the use-after-free condition. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() In… (CVE-2026-74369)
Description
In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish() In luo_file_unpreserve_files() and luo_file_finish(), reorder module_put() and xa_erase() to ensure the file handler module remains pinned while its operations are being accessed. Specifically, luo_get_id() dereferences fh->ops->get_id, so the module reference must be held until after xa_erase() (which calls luo_get_id) completes. For luo_file_finish(), this requires moving the module_put() call out of the luo_file_finish_one() helper and into the main loop of luo_file_finish() itself.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel liveupdate feature involved a use-after-free condition in the functions luo_file_unpreserve_files() and luo_file_finish(). The issue was caused by calling module_put() before xa_erase(), which leads to the file handler module being released prematurely while its operations were still accessed, specifically during a call to luo_get_id(). The fix reordered these calls to keep the module reference held until after xa_erase() completes, preventing the use-after-free scenario.
Potential Impact
This vulnerability could allow kernel memory corruption due to use-after-free, potentially leading to system instability or privilege escalation if exploited. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to reorder module_put() and xa_erase() calls to prevent the use-after-free condition. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-98h5-hm5g-wr83
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-74369"]
Threat ID: 6a808b6abf8831d5394f6620
Added to database: 08/15/2026, 15:53:14 UTC
Last enriched: 08/15/2026, 16:05:33 UTC
Last updated: 09/30/2026, 06:54:41 UTC
Views: 25
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.