The flaw in the Linux kernel’s liveupdate subsystem involves an improper ordering of module reference releases in luo_file_unpreserve_files() and luo_file_finish(). This causes the file handler module to be released while its operations are still in use, potentially leading to a memory corruption or stale pointer situation. The weakness is classified as improper object handling (CWE-911), which in kernel contexts may enable arbitrary code execution or denial of service once the dangling reference is exploited. Based on the description, it is inferred that an attacker with the ability to trigger liveupdate file handling could exercise the freed object, although the CVE does not confirm exploitation in the wild.

The vulnerability affects Linux kernel instances that contain the liveupdate subsystem before the patch that reorders module_put() and xa_erase(). All distributions that ship kernel versions prior to the commit referenced in the advisory are potentially exposed. Exact release versions are not enumerated in the CVE record, so system administrators should verify whether their running kernel contains the fix by inspecting the kernel source or vendor patch notes.

The CVSS score of 5.5 and an EPSS probability of less than 1% indicate a moderate severity but a low likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, suggesting it has not yet been publicly exploited, but the low EPSS score does not preclude a low‑probability risk. Local privileged users or processes that invoke liveupdate functions may be the primary attack vector; remote exploitation would require additional escalation. Administrators should treat this flaw as a security warning and prioritize kernel upgrades, noting improper object handling (CWE-911) issues.