CVE-2026-90291

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the kmod dups code due to improper lifetime handling of kmod dup req instances. The system uses RCU (Read-Copy-Update), a synchronization mechanism that allows multiple readers to access data while it is being updated, to ensure instances are freed only when no longer referenced. However, the kmod dup request exists wait() function does not enter an RCU read-side critical section, which can lead to a use-after-free condition when parallel users reference the instance during a blocking wait for a modprobe command. The kmod dup request delete() function removes the instance from the dup kmod reqs list and frees it after synchronize rcu(), but the lack of proper RCU protection in the wait function creates the flaw.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.