CVE-2026-90291

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

module/dups: Fix use-after-free in kmod_dup_req lifetime handling

The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed

only after it is no longer referenced. When releasing an instance, the

kmod_dup_request_delete() function removes the kmod_dup_req from the

dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.

However, this doesn't work correctly because parallel users referencing the

instance in kmod_dup_request_exists_wait() don't enter an RCU read-side

critical section. This can result in a use-after-free.

The kmod_dup_request_exists_wait() function may need to hold a valid

reference to a kmod_dup_req instance across a blocking wait until the

corresponding modprobe command completes. This makes it unsuitable for RCU.

Fix the issue by changing the lifecycle management of kmod_dup_req to use

reference counting.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References