The vulnerability arises when a user issues a session ioctl that does not match the session type. The liveupdate module does not validate the session type before dispatching the handler, causing the handler to run in an inappropriate context. Calls such as RETRIEVE_FD on an outgoing session trigger recovery code that expects a post‑kexec environment. This mismatch leads to internal errors and a cascade of WARN() messages produced by the kernel, disrupting normal operation rather than enabling code execution or privilege escalation.

The affected product is the Linux kernel. No specific kernel version or patch level is listed in the CNA data, but the issue exists in all builds that contain the liveupdate support path referenced in the kernel source. Users running Linux kernel versions prior to the commit that introduced the type validation are susceptible.

The CVSS and EPSS scores are not provided, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires an attacker to have access to privileged ioctl interfaces, typically available to the kernel, which limits its exploitability to local, privileged or vulnerable user accounts that can open the liveupdate device. While the risk is primarily a service disruption and generate kernel warnings, it does not lead to remote code execution or data exposure. The lack of EPSS data and KEV listing suggests no widespread exploitation has been observed.