CVE-2026-74370 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
liveupdate: fix TOCTOU race in luo_session_retrieve()
Extend the scope of the rwsem_read lock in luo_session_retrieve() to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the session between the lookup and the mutex lock.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel represents a time-of-check to time-of-use race condition within the liveupdate subsystem, specifically affecting the luo_session_retrieve() function. This type of race condition falls under the common weakness enumeration CWE-367 which describes inadequate protection against time-of-check to time-of-use vulnerabilities. The issue occurs when multiple threads attempt to access shared session resources concurrently, creating a window where the system state can change between the check phase and the use phase of an operation.
The technical flaw manifests in the improper locking sequence within the luo_session_retrieve() function where the read-write semaphore lock does not encompass the entire critical section that includes the session mutex acquisition. This gap allows a malicious or concurrent thread to exploit the window between when the session is looked up and when the session mutex is acquired, potentially leading to a use-after-free condition. When such a race occurs, one thread may release and free a session structure while another thread is still attempting to access it, resulting in undefined behavior that could lead to system crashes or privilege escalation.
The operational impact of this vulnerability extends beyond simple system instability to potentially compromise the integrity of the liveupdate functionality itself. In kernel space, such race conditions can be exploited by attackers to gain elevated privileges or cause denial of service conditions that affect the entire system's ability to perform dynamic updates. The vulnerability affects systems running Linux kernels that implement the liveupdate subsystem, particularly those that rely on concurrent session management for runtime module loading and unloading operations. This weakness is especially concerning in environments where frequent kernel updates or module reloading occurs, as it increases the attack surface and potential exploitation window.
Mitigation strategies should focus on ensuring proper lock ordering and extending the scope of existing locks to encompass the complete critical section. The fix implemented involves extending the rwsem_read lock duration to overlap with the session mutex acquisition phase, thereby preventing concurrent threads from releasing sessions between lookup and mutex locking operations. This approach aligns with best practices for concurrent programming in kernel space and follows the principle of least privilege by ensuring that all operations within a critical section are protected by appropriate synchronization primitives. Security practitioners should ensure that affected systems receive immediate patch updates and monitor for any unusual behavior or denial of service conditions that might indicate exploitation attempts. The fix also demonstrates adherence to the ATT&CK framework's concept of privilege escalation through kernel vulnerabilities, where proper lock management prevents attackers from exploiting temporal inconsistencies in system state management.