CVE-2026-68455

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the liveupdate component where session ioctls are not properly validated against session types. Specifically, the PRESERVE FD operation is only applicable to outgoing sessions, while RETRIEVE FD and FINISH are only valid for incoming sessions. Calling an incoming ioctl on an outgoing session can cause file handlers to encounter unexpected errors. For instance, if a user creates an outgoing session and performs a retrieve operation without a kexec (a mechanism to boot a new kernel from the current one), the memfd retrieve handler may execute in an incorrect context. This leads the system to attempt memory restoration via kho restore vmalloc() or kho restore folio(), resulting in internal errors and system warnings. The issue is triggered within the luo session ioctl() function when it fails to validate the operation type before dispatching the handler.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.