Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-74370

liveupdate: fix TOCTOU race in luo_session_retrieve()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luo_session_retrieve() Extend the scope of the rwsem_read lock in luo_session_retrieve() to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the session between the lookup and the mutex lock.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0153094d03df5a2e834a19c59b255649a258ae46 to < d944170607b872a1f93713c555ad3f0efde3a9b8affected
  • 0153094d03df5a2e834a19c59b255649a258ae46 to < d3ae9e7fddb4036f50003d7fa1ef52801fdb961baffected

Linux Linux

Default version status: affected

  • 6.19affected
  • 0 to < 6.19unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References