From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9CBD93D300D for ; Fri, 28 Aug 2026 06:51:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899863; cv=none; b=ZkfY4b+nTutFvWOexKICjJUBy0nhZXMYUeVjWZqYWJrdqywxTLpvar9EOTtGVuCmInJo/C4uLGkY2d9ZdTWZ/dYc748IvPVw8hpggsb+1HEFzoLAXRYXPn7nHcDdieuznopdByIafAS79Gvqm4Ws/v61QaJuCtmS7Xro146fqcw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899863; c=relaxed/simple; bh=gOh9M8T+NJx6VeqCvjdnvy2rY0IjLI8jLrZyq3c+CpY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bWrM6VV523zN6DA0+1/ml/UnlZ4iQmVvr/PqNvW8+OduY0XCLFJE3XG80Udz5lhM/n5BTnxAzL1sQA7A+6hBEt+sDIkvVxDmBk5WFI867Th/FinlKdXfEsrdrQaUrsOXv/kmCHr6KGcL0O/bER04DbsVcxpo0uXSTEFVuPI/8a8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Zmp1npBV; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Zmp1npBV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01EFB1F000E9; Fri, 28 Aug 2026 06:51:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787899862; bh=llhP4dJ/p7evhuukNk/fsmY5Sn+w6rW/Vk000OUvRA4=; h=From:To:Cc:Subject:Date:Reply-To; b=Zmp1npBV1OHhcMK0pPnIzK6F05/JFiC26uBRimX+hUj63oEkV2I9sS65LngkgUCSp nJ5MzGHeZTt8RrW8X9iLvAxzmjfm45Q3cAwOuTpwNRoEdsQvCm4NvwZR0Qmd0e66cL O18y1gh8OqCMefMjxr2fuTQDGU9YaHsXB2wFLoZ0= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80642: liveupdate: Reference count incoming FLB data Date: Fri, 28 Aug 2026 08:49:19 +0200 Message-ID: <2026082841-CVE-2026-80642-1968@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2417; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=jOI5+agMROH4LbeCE7UnkVZXYS0YClP59Jq3vP5HqL8=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkT9T1t534zuj1X7zeHwGmlB35fH8uaXw5ji4orW7zZw 39/o8qqjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZiIdjvDgt2Baxjvntir90KE b2Y2X4HYjluZbAwLthY9doyNCr00NWB+3e0Fx1cVXDrcAQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdate_flb_get_incoming() so that the FLB structure cannot be freed while the caller is actively using it. Add an additional liveupdate_flb_put_incoming() function so the caller can explicitly indicate when it is done using the FLB data. During a Live Update, a subsystem might need to hold onto the incoming File-Lifecycle-Bound (FLB) data for an extended period, such as during device enumeration. Incrementing the reference count guarantees that the data remains valid and accessible until the subsystem releases it, preventing future use-after-free bugs. The Linux kernel CVE team has assigned CVE-2026-80642 to this issue. Affected and fixed versions =========================== Issue introduced in 7.0 with commit cab056f2aae7250af50e503b81a80dfc567a1acd and fixed in 7.1.5 with commit 725ada0273a0f48a67fd59cc518d7f8055fe3d5c Issue introduced in 7.0 with commit cab056f2aae7250af50e503b81a80dfc567a1acd and fixed in 7.2 with commit d8e47bd066d7e626f9f45d416182d585b7e18b9b Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80642 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/linux/liveupdate.h kernel/liveupdate/luo_flb.c lib/tests/liveupdate.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/725ada0273a0f48a67fd59cc518d7f8055fe3d5c https://git.kernel.org/stable/c/d8e47bd066d7e626f9f45d416182d585b7e18b9b