CVE-2026-90291 (GCVE-0-2026-90291)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
module/dups: Fix use-after-free in kmod_dup_req lifetime handling
Summary
In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmod_dup_req lifetime handling The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed only after it is no longer referenced. When releasing an instance, the kmod_dup_request_delete() function removes the kmod_dup_req from the dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it. However, this doesn't work correctly because parallel users referencing the instance in kmod_dup_request_exists_wait() don't enter an RCU read-side critical section. This can result in a use-after-free. The kmod_dup_request_exists_wait() function may need to hold a valid reference to a kmod_dup_req instance across a blocking wait until the corresponding modprobe command completes. This makes it unsuitable for RCU. Fix the issue by changing the lifecycle management of kmod_dup_req to use reference counting.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8660484ed1cf3261e89e0bad94c6395597e87599 , < 2c85e0fb528e039aa8ea1e9c2a1f64347f990541 (git)
Affected: 8660484ed1cf3261e89e0bad94c6395597e87599 , < b2709aad7599f6fd957939b60f4a8323c8f08072 (git)
Affected: 8660484ed1cf3261e89e0bad94c6395597e87599 , < cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca (git)
Affected: 8660484ed1cf3261e89e0bad94c6395597e87599 , < 5eecb11b543f9f417bcf0dea239ff99c6af65dbd (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/module/dups.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2c85e0fb528e039aa8ea1e9c2a1f64347f990541",
              "status": "affected",
              "version": "8660484ed1cf3261e89e0bad94c6395597e87599",
              "versionType": "git"
            },
            {
              "lessThan": "b2709aad7599f6fd957939b60f4a8323c8f08072",
              "status": "affected",
              "version": "8660484ed1cf3261e89e0bad94c6395597e87599",
              "versionType": "git"
            },
            {
              "lessThan": "cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca",
              "status": "affected",
              "version": "8660484ed1cf3261e89e0bad94c6395597e87599",
              "versionType": "git"
            },
            {
              "lessThan": "5eecb11b543f9f417bcf0dea239ff99c6af65dbd",
              "status": "affected",
              "version": "8660484ed1cf3261e89e0bad94c6395597e87599",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/module/dups.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmodule/dups: Fix use-after-free in kmod_dup_req lifetime handling\n\nThe kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed\nonly after it is no longer referenced. When releasing an instance, the\nkmod_dup_request_delete() function removes the kmod_dup_req from the\ndup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.\nHowever, this doesn\u0027t work correctly because parallel users referencing the\ninstance in kmod_dup_request_exists_wait() don\u0027t enter an RCU read-side\ncritical section. This can result in a use-after-free.\n\nThe kmod_dup_request_exists_wait() function may need to hold a valid\nreference to a kmod_dup_req instance across a blocking wait until the\ncorresponding modprobe command completes. This makes it unsuitable for RCU.\n\nFix the issue by changing the lifecycle management of kmod_dup_req to use\nreference counting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in kmod_dup_request_exists_wait(), reached from __request_module() when tracking a duplicate autoload. An unprivileged process hits that via socket(2) \u2192 __sys_socket() \u2192 __sock_create(), which calls request_module(\"net-pf-%d\") for an unloaded protocol family; the trigger is that local syscall, not a remote protocol message.\nAC:L - The attacker drives both sides: one socket() call\u0027s request_module() inserts a kmod_dup_req and kmod_dup_request_announce() queues kmod_dup_request_delete() for 60*HZ, then further socket() calls look up that entry, drop kmod_dup_mutex, and wait_for_completion_state() on first_req_done without rcu_read_lock, racing the delayed kfree.\nPR:L - __request_module() has no capable() check; it only calls security_kernel_module_request(), whose default LSM hook returns 0. __sock_create()\u0027s request_module(\"net-pf-%d\") path has no capability gate either, so a normal unprivileged local user can trigger the duplicate-autoload race.\nUI:N - The attacker issues their own socket() syscalls to force concurrent request_module() calls for the same net-pf-%d name; no other user must mount a filesystem, open a file, or otherwise cooperate.\nS:U - The use-after-free is of a kmalloc\u0027d kmod_dup_req in kernel/module/dups.c and corrupts host kernel heap. That is a standard in-kernel privilege-escalation impact inside one security authority, not a VM or IOMMU boundary crossing.\nC:H - After kmod_dup_request_delete() kfree()s the kmod_dup_req, a racing kmod_dup_request_exists_wait() still reads kmod_req-\u003edup_ret and takes first_req_done.wait.lock inside wait_for_common(). Reclaiming that slab lets the attacker control those contents, a UAF read primitive.\nI:H - wait_for_common() takes first_req_done.wait.lock and can __prepare_to_swait() onto the completion wait queue in the already-freed kmod_dup_req. Heap spraying that object yields an attacker-controlled wait-queue/list write, a UAF write and control-flow hijack primitive.\nA:H - Using a freed kmod_dup_req\u0027s completion spinlock in wait_for_common(), or kfree() racing wait_for_completion_state(\u0026kmod_req-\u003efirst_req_done), oopses or panics the kernel even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:20.524Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2c85e0fb528e039aa8ea1e9c2a1f64347f990541"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2709aad7599f6fd957939b60f4a8323c8f08072"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/5eecb11b543f9f417bcf0dea239ff99c6af65dbd"
        }
      ],
      "title": "module/dups: Fix use-after-free in kmod_dup_req lifetime handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90291",
    "datePublished": "2026-09-17T16:08:18.700Z",
    "dateReserved": "2026-09-11T19:38:34.798Z",
    "dateUpdated": "2026-09-18T17:54:20.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90291",
      "date": "2026-09-29",
      "epss": "0.0017",
      "percentile": "0.05664"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T02:50:43.000Z",
      "cve": "CVE-2026-90291",
      "id": "msrc_CVE-2026-90291",
      "initial_release_date": "2026-09-19T01:03:27.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "module/dups: Fix use-after-free in kmod_dup_req lifetime handling",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90291.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/module/dups.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2c85e0fb528e039aa8ea1e9c2a1f64347f990541",
                    "status": "affected",
                    "version": "8660484ed1cf3261e89e0bad94c6395597e87599",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b2709aad7599f6fd957939b60f4a8323c8f08072",
                    "status": "affected",
                    "version": "8660484ed1cf3261e89e0bad94c6395597e87599",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca",
                    "status": "affected",
                    "version": "8660484ed1cf3261e89e0bad94c6395597e87599",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5eecb11b543f9f417bcf0dea239ff99c6af65dbd",
                    "status": "affected",
                    "version": "8660484ed1cf3261e89e0bad94c6395597e87599",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/module/dups.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmodule/dups: Fix use-after-free in kmod_dup_req lifetime handling\n\nThe kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed\nonly after it is no longer referenced. When releasing an instance, the\nkmod_dup_request_delete() function removes the kmod_dup_req from the\ndup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.\nHowever, this doesn\u0027t work correctly because parallel users referencing the\ninstance in kmod_dup_request_exists_wait() don\u0027t enter an RCU read-side\ncritical section. This can result in a use-after-free.\n\nThe kmod_dup_request_exists_wait() function may need to hold a valid\nreference to a kmod_dup_req instance across a blocking wait until the\ncorresponding modprobe command completes. This makes it unsuitable for RCU.\n\nFix the issue by changing the lifecycle management of kmod_dup_req to use\nreference counting."
          }
        ],
        "id": "CVE-2026-90291",
        "lastModified": "2026-09-18T18:17:52.007",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:26.263",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2c85e0fb528e039aa8ea1e9c2a1f64347f990541"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5eecb11b543f9f417bcf0dea239ff99c6af65dbd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b2709aad7599f6fd957939b60f4a8323c8f08072"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:29:34Z",
      "cve": "CVE-2026-90291",
      "id": "CVE-2026-90291",
      "initial_release_date": "2026-09-18T00:18:44Z",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90291",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90291.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.