CVE-2026-90291
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A memory-handling mistake in the Linux kernel could allow someone already logged into the computer to gain complete control of the machine.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Medium
What it actually does
Use-after-free in Linux kernel kmod_dup_req lifetime management caused by missing RCU read-side critical sections in kmod_dup_request_exists_wait while kmod_dup_request_delete uses synchronize_rcu before freeing.
Why it matters to the business
Local attackers can achieve kernel-level code execution on affected Linux systems, resulting in full host compromise and potential lateral movement or persistence.
How an attack unfolds
A local attacker triggers concurrent module duplicate request operations; one path deletes and frees the request structure after synchronize_rcu while a parallel waiter still holds a dangling reference across a blocking wait, leading to memory corruption.
How to fix it
Upgrade the Linux kernel to a version that replaces RCU-based lifetime handling with proper reference counting for kmod_dup_req objects.
How to confirm the fix worked
Inspect kernel source or runtime symbols to confirm kmod_dup_request_exists_wait and related functions now perform reference count operations instead of relying solely on synchronize_rcu before free.
Typical attack path
- Obtain local unprivileged access on a vulnerable Linux host
- Trigger repeated or concurrent modprobe/kmod operations that invoke kmod_dup_request_exists_wait and deletion paths
- Trigger the race to access freed kmod_dup_req memory for corruption or control-flow hijack
How to detect it
Review kernel logs and crash dumps for kmod_dup_req related use-after-free warnings, oops traces mentioning module/dups or kmod_dup_request_delete, and unusual concurrent modprobe activity.
What your security team should do
- Prioritize kernel package updates on all Linux systems
- Restrict local user access and module loading privileges where feasible
- Enable kernel hardening features such as KASAN or lockdep in test environments to surface similar lifetime bugs
The record
In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmod_dup_req lifetime handling The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed only after it is no longer referenced. When releasing an instance, the kmod_dup_request_delete() function removes the kmod_dup_req from the dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it. However, this doesn't work correctly because parallel users referencing the instance in kmod_dup_request_exists_wait() don't enter an RCU read-side critical section. This can result in a use-after-free. The kmod_dup_request_exists_wait() function may need to hold a valid reference to a kmod_dup_req instance across a blocking wait until the corresponding modprobe command completes. This makes it unsuitable for RCU. Fix the issue by changing the lifecycle management of kmod_dup_req to use reference counting.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|