CVE-2026-43489: Liveupdate File Handling in Linux Kernel

The vulnerability lies in the luo_file structure within the liveupdate subsystem. Specifically, the retrieve boolean, which tracks whether a file has been successfully retrieved, is not consistently managed. Multiple retrievals of the same file can occur, leading to the serialized data structures being freed while the code still attempts to process them. This can result in the kernel attempting to operate on invalid or corrupted data, potentially leading to a crash, unexpected behavior, or even privilege escalation depending on the liveupdate functionality being exploited. While direct remote exploitation is unlikely, a malicious actor with local access or control over the liveupdate mechanism could trigger this condition.

1. Reservado2026-05-01
2. Publicada2026-05-13
3. EPSS atualizado2026-05-14

The primary mitigation for CVE-2026-43489 is to upgrade the Linux Kernel to version f85b1c6af5bc3872f994df0a5688c1162de07a62 or later. If an immediate upgrade is not feasible, consider temporarily disabling the liveupdate functionality if it's not critical for your system. Review any custom liveupdate scripts or configurations to ensure they are not inadvertently triggering multiple retrievals of the same file. Monitor system logs for any unusual errors related to liveupdate or file handling, which could indicate exploitation attempts. After upgrading, confirm the fix by verifying the kernel version using uname -r and ensuring it is greater than or equal to f85b1c6af5bc3872f994df0a5688c1162de07a62.