CVE-2026-90291: module/dups: Fix use-after-free in kmod_dup_req lifetime handling
In the Linux kernel, the following vulnerability has been resolved:
module/dups: Fix use-after-free in kmoddupreq lifetime handling
The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete() function removes the kmoddupreq from the dupkmodreqs list, waits via synchronizercu() and finally frees it. However, this doesn't work correctly because parallel users referencing the instance in kmodduprequestexistswait() don't enter an RCU read-side critical section. This can result in a use-after-free.
The kmodduprequestexistswait() function may need to hold a valid reference to a kmoddupreq instance across a blocking wait until the corresponding modprobe command completes. This makes it unsuitable for RCU.
Fix the issue by changing the lifecycle management of kmoddupreq to use reference counting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Change the lifecycle management of kmod_dup_req to use reference counting rather than relying on RCU for references held across the blocking wait in kmod_dup_request_exists_wait().
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
The issue requires concurrent use of kmod_dup_req objects: one path releases and deletes an instance while another path uses kmod_dup_request_exists_wait() and retains the instance across a blocking wait for the associated modprobe command to complete.
Which systems are exposed?
Systems running an affected Linux kernel are exposed when the kernel's module duplicate-request handling is exercised under the relevant concurrent request and release conditions. The provided information does not identify affected kernel versions or configurations.
How can this issue be remediated?
Apply a kernel update containing the lifecycle-management change from RCU-based freeing to reference counting for kmod_dup_req instances. The supplied references identify stable kernel commits containing the fix.