In the Linux kernel, failure to increment the reference count for incoming File‑Lifecycle‑Bound (FLB) data in the liveupdate subsystem creates a use‑after‑free condition. The FLB structure may be freed while still in use, potentially corrupting kernel memory. If an attacker can trigger a live update that processes the vulnerable FLB data, arbitrary code execution with kernel privileges could result.

All Linux kernel versions that include the liveupdate module but lack the reference‑count fix are affected. The defect was addressed in commits 725ada0273a0f48a67fd59cc518d7f8055fe3d5c and d8e47bd066d7e626f9f45d416182d585b7e18b9b. The vulnerability is not tied to any specific distribution release; any distribution shipping an unfixed kernel, including custom builds, remains at risk.

The vulnerability has a CVSS score of 5.5 and an EPSS score of <1%, indicating moderate severity and low exploitation likelihood. It is not listed in the CISA KEV catalog. An attacker would need local or kernel‑privileged code to initiate a live update that uses the FLB data. Successful exploitation could lead to kernel memory corruption and privilege escalation, compromising the entire system.