---
id: CVE-2026-90291
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  module/dups: Fix use-after-free in kmod_dup_req lifetime handling

  The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed
  only after it is no longe…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  module/dups: Fix use-after-free in kmod_dup_req lifetime handling

  The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed
  only after it is no longe…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8660484ed1cf3261e89e0bad94c6395597e87599 <
    2c85e0fb528e039aa8ea1e9c2a1f64347f990541
  - >-
    Linux >= 8660484ed1cf3261e89e0bad94c6395597e87599 <
    b2709aad7599f6fd957939b60f4a8323c8f08072
  - >-
    Linux >= 8660484ed1cf3261e89e0bad94c6395597e87599 <
    cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca
  - >-
    Linux >= 8660484ed1cf3261e89e0bad94c6395597e87599 <
    5eecb11b543f9f417bcf0dea239ff99c6af65dbd
  - Linux 6.4
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:52.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90291'
references:
  - url: 'https://git.kernel.org/stable/c/2c85e0fb528e039aa8ea1e9c2a1f64347f990541'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5eecb11b543f9f417bcf0dea239ff99c6af65dbd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b2709aad7599f6fd957939b60f4a8323c8f08072'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.0017
epssPercentile: 0.0558
ingestedAt: '2026-09-17T16:21:47.832Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

module/dups: Fix use-after-free in kmod_dup_req lifetime handling

The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed
only after it is no longer referenced. When releasing an instance, the
kmod_dup_request_delete() function removes the kmod_dup_req from the
dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.
However, this doesn't work correctly because parallel users referencing the
instance in kmod_dup_request_exists_wait() don't enter an RCU read-side
critical section. This can result in a use-after-free.

The kmod_dup_request_exists_wait() function may need to hold a valid
reference to a kmod_dup_req instance across a blocking wait until the
corresponding modprobe command completes. This makes it unsuitable for RCU.

Fix the issue by changing the lifecycle management of kmod_dup_req to use
reference counting.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.