CVE-2026-43489

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

liveupdate: luo_file: remember retrieve() status

LUO keeps track of successful retrieve attempts on a LUO file. It does so

to avoid multiple retrievals of the same file. Multiple retrievals cause

problems because once the file is retrieved, the serialized data

structures are likely freed and the file is likely in a very different

state from what the code expects.

The retrieve boolean in struct luo_file keeps track of this, and is passed

to the finish callback so it knows what work was already done and what it

has left to do.

All this works well when retrieve succeeds. When it fails,

luo_retrieve_file() returns the error immediately, without ever storing

anywhere that a retrieve was attempted or what its error code was. This

results in an errored LIVEUPDATE_SESSION_RETRIEVE_FD ioctl to userspace,

but nothing prevents it from trying this again.

The retry is problematic for much of the same reasons listed above.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References