CVE-2026-74369

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()

In luo_file_unpreserve_files() and luo_file_finish(), reorder

module_put() and xa_erase() to ensure the file handler module remains

pinned while its operations are being accessed.

Specifically, luo_get_id() dereferences fh->ops->get_id, so the module

reference must be held until after xa_erase() (which calls luo_get_id)

completes.

For luo_file_finish(), this requires moving the module_put() call out of

the luo_file_finish_one() helper and into the main loop of

luo_file_finish() itself.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References