module/dups: Fix use-after-free in kmod_dup_req lifetime handling
CVE-2026-90291 · published 17 Sept 2026
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-90291?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 8660484ed1cf3261e89e0bad94c6395597e87599 to < a3205bd1f218053575589b14caf8df667f344134, 8660484ed1cf3261e89e0bad94c6395597e87599 to < 2c85e0fb528e039aa8ea1e9c2a1f64347f990541, 8660484ed1cf3261e89e0bad94c6395597e87599 to < b2709aad7599f6fd957939b60f4a8323c8f08072, 8660484ed1cf3261e89e0bad94c6395597e87599 to < cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca
- Linux Linux: 6.4
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
module/dups: Fix use-after-free in kmod_dup_req lifetime handling
The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed
only after it is no longer referenced. When releasing an instance, the
kmod_dup_request_delete() function removes the kmod_dup_req from the
dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.
However, this doesn't work correctly because parallel users referencing the
instance in kmod_dup_request_exists_wait() don't enter an RCU read-side
critical section. This can result in a use-after-free.
The kmod_dup_request_exists_wait() function may need to hold a valid
reference to a kmod_dup_req instance across a blocking wait until the
corresponding modprobe command completes. This makes it unsuitable for RCU.
Fix the issue by changing the lifecycle management of kmod_dup_req to use
reference counting.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/a3205bd1f218053575589b14caf8df667f344134
- git.kernel.org/stable/c/2c85e0fb528e039aa8ea1e9c2a1f64347f990541
- git.kernel.org/stable/c/b2709aad7599f6fd957939b60f4a8323c8f08072
- git.kernel.org/stable/c/cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca
- git.kernel.org/stable/c/5eecb11b543f9f417bcf0dea239ff99c6af65dbd
Merged from CVE List. Last updated 26 Oct 2026. All vulnerabilities · RSS · JSON