{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74370", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.888Z", "datePublished": "2026-08-15T05:58:50.933Z", "dateUpdated": "2026-08-17T05:18:05.573Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:18:05.573Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nliveupdate: fix TOCTOU race in luo_session_retrieve()\n\nExtend the scope of the rwsem_read lock in luo_session_retrieve() to\noverlap with the acquisition of the session mutex. This prevents a\nconcurrent thread from releasing and freeing the session between the\nlookup and the mutex lock."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/liveupdate/luo_session.c"], "versions": [{"version": "0153094d03df5a2e834a19c59b255649a258ae46", "lessThan": "d944170607b872a1f93713c555ad3f0efde3a9b8", "status": "affected", "versionType": "git"}, {"version": "0153094d03df5a2e834a19c59b255649a258ae46", "lessThan": "d3ae9e7fddb4036f50003d7fa1ef52801fdb961b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/liveupdate/luo_session.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d944170607b872a1f93713c555ad3f0efde3a9b8"}, {"url": "https://git.kernel.org/stable/c/d3ae9e7fddb4036f50003d7fa1ef52801fdb961b"}], "title": "liveupdate: fix TOCTOU race in luo_session_retrieve()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/liveupdate/luo_session.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d944170607b872a1f93713c555ad3f0efde3a9b8", "status": "affected", "version": "0153094d03df5a2e834a19c59b255649a258ae46", "versionType": "git"}, {"lessThan": "d3ae9e7fddb4036f50003d7fa1ef52801fdb961b", "status": "affected", "version": "0153094d03df5a2e834a19c59b255649a258ae46", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/liveupdate/luo_session.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nliveupdate: fix TOCTOU race in luo_session_retrieve()\n\nExtend the scope of the rwsem_read lock in luo_session_retrieve() to\noverlap with the acquisition of the session mutex. This prevents a\nconcurrent thread from releasing and freeing the session between the\nlookup and the mutex lock."}], "id": "CVE-2026-74370", "lastModified": "2026-08-17T06:19:31.823", "metrics": {}, "published": "2026-08-15T06:22:38.750", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d3ae9e7fddb4036f50003d7fa1ef52801fdb961b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d944170607b872a1f93713c555ad3f0efde3a9b8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: liveupdate: fix TOCTOU race in luo_session_retrieve()", "id": "2516880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516880"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nliveupdate: fix TOCTOU race in luo_session_retrieve()\nExtend the scope of the rwsem_read lock in luo_session_retrieve() to\noverlap with the acquisition of the session mutex. This prevents a\nconcurrent thread from releasing and freeing the session between the\nlookup and the mutex lock.", "A flaw was found in the Linux kernel's liveupdate module. This vulnerability involves a Time-of-check to Time-of-use (TOCTOU) race condition within the `luo_session_retrieve()` function. A concurrent thread could release and free a session after it has been looked up but before a necessary mutex lock is acquired. This could lead to unpredictable behavior or a denial of service."], "name": "CVE-2026-74370", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74370\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74370\nhttps://lore.kernel.org/linux-cve-announce/2026081503-CVE-2026-74370-29f3@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0153094d03df5a2e834a19c59b255649a258ae46,d944170607b872a1f93713c555ad3f0efde3a9b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0153094d03df5a2e834a19c59b255649a258ae46,d3ae9e7fddb4036f50003d7fa1ef52801fdb961b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T17:30:11.724007+00:00", "updated": "2026-08-22T02:00:17.913491+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}