CVE-2026-80642

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80642", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.778Z", "datePublished": "2026-08-28T06:48:53.841Z", "dateUpdated": "2026-08-28T06:48:53.841Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-28T06:48:53.841Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nliveupdate: Reference count incoming FLB data\n\nIncrement the incoming FLB refcount in liveupdate_flb_get_incoming() so\nthat the FLB structure cannot be freed while the caller is actively using\nit. Add an additional liveupdate_flb_put_incoming() function so the\ncaller can explicitly indicate when it is done using the FLB data.\n\nDuring a Live Update, a subsystem might need to hold onto the incoming\nFile-Lifecycle-Bound (FLB) data for an extended period, such as during\ndevice enumeration. Incrementing the reference count guarantees that the\ndata remains valid and accessible until the subsystem releases it,\npreventing future use-after-free bugs."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/liveupdate.h", "kernel/liveupdate/luo_flb.c", "lib/tests/liveupdate.c"], "versions": [{"version": "cab056f2aae7250af50e503b81a80dfc567a1acd", "lessThan": "725ada0273a0f48a67fd59cc518d7f8055fe3d5c", "status": "affected", "versionType": "git"}, {"version": "cab056f2aae7250af50e503b81a80dfc567a1acd", "lessThan": "d8e47bd066d7e626f9f45d416182d585b7e18b9b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/liveupdate.h", "kernel/liveupdate/luo_flb.c", "lib/tests/liveupdate.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/725ada0273a0f48a67fd59cc518d7f8055fe3d5c"}, {"url": "https://git.kernel.org/stable/c/d8e47bd066d7e626f9f45d416182d585b7e18b9b"}], "title": "liveupdate: Reference count incoming FLB data", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/liveupdate.h", "kernel/liveupdate/luo_flb.c", "lib/tests/liveupdate.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "725ada0273a0f48a67fd59cc518d7f8055fe3d5c", "status": "affected", "version": "cab056f2aae7250af50e503b81a80dfc567a1acd", "versionType": "git"}, {"lessThan": "d8e47bd066d7e626f9f45d416182d585b7e18b9b", "status": "affected", "version": "cab056f2aae7250af50e503b81a80dfc567a1acd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/liveupdate.h", "kernel/liveupdate/luo_flb.c", "lib/tests/liveupdate.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nliveupdate: Reference count incoming FLB data\n\nIncrement the incoming FLB refcount in liveupdate_flb_get_incoming() so\nthat the FLB structure cannot be freed while the caller is actively using\nit. Add an additional liveupdate_flb_put_incoming() function so the\ncaller can explicitly indicate when it is done using the FLB data.\n\nDuring a Live Update, a subsystem might need to hold onto the incoming\nFile-Lifecycle-Bound (FLB) data for an extended period, such as during\ndevice enumeration. Incrementing the reference count guarantees that the\ndata remains valid and accessible until the subsystem releases it,\npreventing future use-after-free bugs."}], "id": "CVE-2026-80642", "lastModified": "2026-08-28T08:16:49.097", "metrics": {}, "published": "2026-08-28T08:16:49.097", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/725ada0273a0f48a67fd59cc518d7f8055fe3d5c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d8e47bd066d7e626f9f45d416182d585b7e18b9b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: liveupdate: Reference count incoming FLB data", "id": "2525405", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525405"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nliveupdate: Reference count incoming FLB data\nIncrement the incoming FLB refcount in liveupdate_flb_get_incoming() so\nthat the FLB structure cannot be freed while the caller is actively using\nit. Add an additional liveupdate_flb_put_incoming() function so the\ncaller can explicitly indicate when it is done using the FLB data.\nDuring a Live Update, a subsystem might need to hold onto the incoming\nFile-Lifecycle-Bound (FLB) data for an extended period, such as during\ndevice enumeration. Incrementing the reference count guarantees that the\ndata remains valid and accessible until the subsystem releases it,\npreventing future use-after-free bugs.", "A flaw was found in the Linux kernel's liveupdate subsystem. This vulnerability arises from improper reference counting of incoming File-Lifecycle-Bound (FLB) data. A subsystem might hold onto FLB data for an extended period, and without proper reference counting, the FLB structure could be prematurely freed while still in use. This can lead to use-after-free bugs, potentially resulting in memory corruption."], "name": "CVE-2026-80642", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80642\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80642\nhttps://lore.kernel.org/linux-cve-announce/2026082841-CVE-2026-80642-1968@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cab056f2aae7250af50e503b81a80dfc567a1acd,725ada0273a0f48a67fd59cc518d7f8055fe3d5c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cab056f2aae7250af50e503b81a80dfc567a1acd,d8e47bd066d7e626f9f45d416182d585b7e18b9b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T09:30:18.289983+00:00", "updated": "2026-09-02T05:30:08.150975+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}