UBUNTU-CVE-2026-90291: Use After Free
In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete() function removes the kmoddupreq from the dupkmodreqs list, waits via synchronizercu() and finally frees it. However, this doesn't work correctly because parallel users referencing the instance in kmodduprequestexistswait() don't enter an RCU read-side critical section. This can result in a use-after-free. The kmodduprequestexistswait() function may need to hold a valid reference to a kmoddupreq instance across a blocking wait until the corresponding modprobe command completes. This makes it unsuitable for RCU. Fix the issue by changing the lifecycle management of kmoddupreq to use reference counting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Change kmod_dup_req lifecycle management to use reference counting, ensuring kmod_dup_request_exists_wait() holds a valid reference across its blocking wait until the corresponding modprobe command completes; do not rely on RCU for this wait because the function does not enter an RCU read-side critical section.