CVE-2026-74369: liveupdate: fix u-a-f in luo_file_unpreserve_files() and luo_file_finish()
In the Linux kernel, the following vulnerability has been resolved:
liveupdate: fix u-a-f in luofileunpreservefiles() and luofilefinish()
In luofileunpreservefiles() and luofilefinish(), reorder moduleput() and xaerase() to ensure the file handler module remains pinned while its operations are being accessed.
Specifically, luogetid() dereferences fh->ops->getid, so the module reference must be held until after xaerase() (which calls luogetid) completes.
For luofilefinish(), this requires moving the moduleput() call out of the luofilefinishone() helper and into the main loop of luofilefinish() itself.