Bug 2525405 (CVE-2026-80642)

Summary: CVE-2026-80642 kernel: liveupdate: Reference count incoming FLB data
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's liveupdate subsystem. This vulnerability arises from improper reference counting of incoming File-Lifecycle-Bound (FLB) data. A subsystem might hold onto FLB data for an extended period, and without proper reference counting, the FLB structure could be prematurely freed while still in use. This can lead to use-after-free bugs, potentially resulting in memory corruption.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-28 07:43:20 UTC 
In the Linux kernel, the following vulnerability has been resolved:

liveupdate: Reference count incoming FLB data

Increment the incoming FLB refcount in liveupdate_flb_get_incoming() so
that the FLB structure cannot be freed while the caller is actively using
it. Add an additional liveupdate_flb_put_incoming() function so the
caller can explicitly indicate when it is done using the FLB data.

During a Live Update, a subsystem might need to hold onto the incoming
File-Lifecycle-Bound (FLB) data for an extended period, such as during
device enumeration. Incrementing the reference count guarantees that the
data remains valid and accessible until the subsystem releases it,
preventing future use-after-free bugs.
Comment 1 gkamathe 2026-08-31 10:43:03 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082841-CVE-2026-80642-1968@gregkh/T