CVE-2026-80642: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80642 Overview

CVE-2026-80642 is a use-after-free vulnerability in the Linux kernel's liveupdate subsystem. The flaw resides in the handling of File-Lifecycle-Bound (FLB) data during a Live Update operation. The liveupdate_flb_get_incoming() function returned a pointer to the incoming FLB structure without incrementing its reference count. A concurrent release could free the FLB structure while a subsystem still held a reference, producing a use-after-free condition. The fix adds proper reference counting and introduces a matching liveupdate_flb_put_incoming() function so callers can explicitly signal when they are done using the data.

Critical Impact
A use-after-free in kernel liveupdate FLB handling can lead to memory corruption, kernel panic, or local privilege escalation on hosts running affected Linux kernel builds.

Affected Products

Linux kernel builds that include the liveupdate subsystem with FLB support
Downstream distributions shipping the affected liveupdate code prior to the fix commits
Systems using Live Update device enumeration flows that consume incoming FLB data

Discovery Timeline

2026-08-28 - CVE-2026-80642 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80642

Vulnerability Analysis

The Linux kernel liveupdate subsystem manages state that must be preserved across a Live Update of the running kernel. File-Lifecycle-Bound (FLB) structures carry per-file state that incoming subsystems consume during device enumeration after the update. The liveupdate_flb_get_incoming() accessor returned a reference to the FLB object without holding it. A caller could therefore continue to dereference the structure after another code path released and freed it, producing a use-after-free.

Kernel use-after-free defects of this class can be leveraged for memory corruption. Depending on allocator state and how the freed slab is reused, an attacker with local access on an affected system may influence kernel memory to escalate privileges or crash the host.

Root Cause

The root cause is missing reference counting on the incoming FLB object. The getter handed out a raw pointer while the object's lifetime was controlled elsewhere. Any code path that freed or replaced the FLB while a subsystem was still using it created a dangling pointer. This is a lifetime management defect and maps to the Use-After-Free vulnerability class.

Attack Vector

The defect is reachable through the liveupdate code paths that process incoming FLB data, typically during device enumeration on the post-update kernel. Exploitation requires local execution context that can reach these code paths or influence their timing. The upstream patches, commits 725ada0 and d8e47bd, correct the lifetime handling by incrementing the refcount in liveupdate_flb_get_incoming() and adding liveupdate_flb_put_incoming() for explicit release.

// No verified public exploit code is available for CVE-2026-80642.
// See the referenced kernel commits for the corrective patch details.

Detection Methods for CVE-2026-80642

Indicators of Compromise

Unexpected kernel oops or panic messages referencing liveupdate or FLB helpers in dmesg or the kernel journal
KASAN use-after-free reports in kernel logs mentioning liveupdate_flb_get_incoming or related symbols
Repeated crashes or reboots correlated with Live Update device enumeration on affected hosts

Detection Strategies

Inventory running kernel versions and compare against distribution advisories that reference commits 725ada0 and d8e47bd.
Enable KASAN or KFENCE on test kernels to surface use-after-free access patterns in liveupdate code paths.
Correlate crash telemetry with hosts that perform Live Update operations to identify likely impact.

Monitoring Recommendations

Forward kernel logs to a centralized log store and alert on BUG: KASAN, use-after-free, and liveupdate string matches.
Track kernel package versions across the fleet and flag hosts that have not received the fix commits.
Monitor for anomalous local privilege escalation behavior on servers that use Live Update workflows.

How to Mitigate CVE-2026-80642

Immediate Actions Required

Identify all hosts running kernels that include the liveupdate FLB code without the fix commits.
Apply the vendor-provided kernel update that incorporates commits 725ada0 and d8e47bd.
Reboot affected hosts after patching to load the corrected kernel image.

Patch Information

The upstream fix increments the FLB refcount inside liveupdate_flb_get_incoming() and introduces liveupdate_flb_put_incoming() so callers can release the reference explicitly. The corrective changes are available in the mainline stable tree at Linux Kernel Commit 725ada0 and Linux Kernel Commit d8e47bd. Downstream distributions will backport these commits into their supported kernel series.

Workarounds

Restrict local access on affected systems to trusted administrators until patched kernels are deployed.
Avoid initiating Live Update operations on unpatched hosts where feasible.
Where supported by the distribution, disable or unload the liveupdate subsystem on hosts that do not require it.

bash

# Verify the running kernel version and check for the fix commits in your distribution's changelog
uname -r
# Example: query installed kernel package metadata (Debian/Ubuntu)
dpkg -l | grep linux-image
# Example: query installed kernel package metadata (RHEL/Fedora)
rpm -q kernel