CVE-2026-80642
Received Received - Intake

Live Update Reference Counting Flaw in Linux Kernel

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdate_flb_get_incoming() so that the FLB structure cannot be freed while the caller is actively using it. Add an additional liveupdate_flb_put_incoming() function so the caller can explicitly indicate when it is done using the FLB data. During a Live Update, a subsystem might need to hold onto the incoming File-Lifecycle-Bound (FLB) data for an extended period, such as during device enumeration. Incrementing the reference count guarantees that the data remains valid and accessible until the subsystem releases it, preventing future use-after-free bugs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80642
EUVD
EUVD-2026-67518

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a reference count issue in the Linux kernel's liveupdate functionality. During a Live Update, the system needs to hold incoming File-Lifecycle-Bound (FLB) data for tasks like device enumeration. The flaw occurs when the FLB data's reference count is not properly incremented, risking use-after-free bugs if the data is freed while still in use.

Detection Guidance

This vulnerability is specific to the Linux kernel's liveupdate functionality and involves improper reference counting of FLB data. Detection requires checking kernel logs for liveupdate-related errors or crashes during system updates. No direct commands are provided in the context to detect this issue.

Impact Analysis

If exploited, this could lead to system crashes, data corruption, or privilege escalation due to use-after-free conditions. Systems relying on live updates or handling FLB data during updates may experience instability or security breaches.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a reference count issue in the Linux kernel's liveupdate functionality, which could lead to use-after-free bugs during device enumeration. There is no evidence in the provided context that this issue impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel logs for liveupdate-related errors. Ensure your system is running a kernel version that includes the fix for this reference counting issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart