CVE-2026-43389 Overview
CVE-2026-43389 is a Linux kernel vulnerability in the memfd_luo (Live Update Orchestrator) subsystem. The flaw affects how the kernel preserves memfd folio state across live update operations. The kernel saves the dirty flag of a folio at preserve() time, but folios may be dirtied after that point. After a live update, the next kernel sees these folios as clean and may reclaim them under memory pressure, resulting in user data loss.
Critical Impact
Loss of user data in memfd-backed memory regions after a Linux live update, when previously clean folios are dirtied between preserve() and the actual update.
Affected Products
- Linux kernel versions containing the memfd_luo live update preservation feature
- Workloads using memfd preservation with Live Update Orchestrator (LUO)
- Systems performing kernel live updates with memfd-backed memory
Discovery Timeline
- 2026-05-08 - CVE-2026-43389 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43389
Vulnerability Analysis
The vulnerability resides in the memfd preservation logic used by the Linux Live Update Orchestrator (LUO). A dirty folio is one that has been written to and contains user data; a clean folio has no such data and may be freed under memory pressure. The LUO mechanism serializes folio state, including the dirty flag, so that a successor kernel can correctly restore memfd contents after a live update.
The original implementation captured the dirty flag during preserve(). This snapshot is stale because folios may be written to after preserve() runs. Capturing it at freeze() is also insufficient, because the PTE dirty bit is normally synced at unmap, and active mappings to the file may still exist at freeze() time.
Root Cause
The root cause is a time-of-check to time-of-use issue in serializing folio dirty state. The kernel records folio metadata at one point in time, but the actual dirty state can change before the live update completes. The serialized state therefore misrepresents the folio as clean when it should be dirty.
Attack Vector
This is a data integrity defect triggered by normal kernel operation during a live update, not a typical remote or local attack vector. A folio clean at preserve() that is subsequently written to is serialized as clean. After retrieval in the successor kernel, the memory manager treats the folio as reclaimable. Under memory pressure, the kernel frees the folio, discarding user data that the application expected to persist across the live update.
The fix marks every folio of the file as dirty and unconditionally sets MEMFD_LUO_FOLIO_DIRTY. Because the flag value is now constant, the patch removes the dynamic flags variable and assigns it directly. The trade-off is that all preserved folios become non-reclaimable, which is acceptable for live update participants. See the kernel commit 7e04bf1f33151a30e06a65b74b5f2c19fc2be128 and kernel commit e901c871d4b592f0042e30f3a0f031eae79744ec for the upstream resolution.
Detection Methods for CVE-2026-43389
Indicators of Compromise
- Unexpected data corruption or zeroed pages in memfd-backed regions after a live kernel update
- Application-level integrity failures reported immediately following an LUO transition
- Kernel logs showing folio reclamation activity on memfd regions tied to LUO participants
Detection Strategies
- Inventory hosts running kernels that include memfd_luo preservation and identify those using live update workflows
- Compare installed kernel commit hashes against the fixed commits referenced in the upstream resolution
- Audit applications using memfd with LUO for post-update data validation checks
Monitoring Recommendations
- Track kernel package versions across the fleet and alert on hosts missing the fix commits
- Monitor dmesg and memory subsystem telemetry for anomalous reclamation events during or after live updates
- Capture application error rates around live update windows to detect silent memfd data loss
How to Mitigate CVE-2026-43389
Immediate Actions Required
- Apply the upstream Linux kernel patches that mark all memfd LUO folios as dirty
- Defer non-essential live updates on hosts running affected kernels until the fix is deployed
- Validate memfd content integrity after any live update on unpatched systems
Patch Information
The issue is resolved upstream by always dirtying all folios during memfd LUO preservation and unconditionally setting the MEMFD_LUO_FOLIO_DIRTY flag. The relevant commits are 7e04bf1f33151a30e06a65b74b5f2c19fc2be128 and e901c871d4b592f0042e30f3a0f031eae79744ec. Distribution-supplied kernels should be updated as soon as backports are available.
Workarounds
- Avoid using memfd preservation with LUO on unpatched kernels where data integrity is required
- Suspend live update operations on production workloads using memfd-backed memory until patched kernels are deployed
- Where feasible, reduce memory pressure on successor kernels to lower the chance of reclamation of misclassified clean folios
# Verify the running kernel version and check distribution advisories for the fix
uname -r
# Example: check that the kernel package includes the upstream fix commits
# (replace with your distribution's package manager and security advisory lookup)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
