CVE-2026-74370
Received Received - Intake

Race Condition in Linux Kernel Liveupdate Component

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luo_session_retrieve() Extend the scope of the rwsem_read lock in luo_session_retrieve() to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the session between the lookup and the mutex lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74370
EUVD
EUVD-2026-59517

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a TOCTOU (Time-of-Check to Time-of-Use) race condition in the Linux kernel's liveupdate feature. It occurs in the luo_session_retrieve() function where a concurrent thread could release and free a session object between the time it is looked up and when a mutex lock is acquired, leading to potential use-after-free or other memory corruption issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's liveupdate functionality and involves a TOCTOU race condition in luo_session_retrieve(). Detection requires checking kernel logs for race condition warnings or crashes in liveupdate components. No direct commands are provided, but monitoring kernel logs with dmesg or journalctl may reveal issues.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a race condition, potentially causing system crashes, privilege escalation, or arbitrary code execution. It primarily affects systems using the Linux kernel's liveupdate functionality.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Since the vulnerability is fixed in a specific kernel version, updating to the patched version is the primary mitigation. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74370. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart