CVE-2026-90291 module/dups: Fix use-after-free in kmod_dup_req lifetime handling
A use-after-free in the Linux kernel module duplication code allows attackers to execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90291?
CVE-2026-90291 is a high-severity use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
module/dups: Fix use-after-free in kmod_dup_req lifetime handling
The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed only after it is no longer referenced. When releasing an instance, the kmod_dup_request_delete() function removes the kmod_dup_req from the dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it. However, this doesn't work correctly because parallel users referencing the instance in kmod_dup_request_exists_wait() don't enter an RCU read-side critical section. This can result in a use-after-free.
The kmod_dup_request_exists_wait() function may need to hold a valid reference to a kmod_dup_req instance across a blocking wait until the corresponding modprobe command completes. This makes it unsuitable for RCU.
Fix the issue by changing the lifecycle management of kmod_dup_req to use reference counting.
Which versions are affected by CVE-2026-90291?
How do I fix CVE-2026-90291?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90291 being exploited?
There is no known exploitation of CVE-2026-90291 in the wild and no public exploit code.
Sources
Also known as AZL-101870, BELL-CVE-2026-90291, DEBIAN-CVE-2026-90291, GHSA-hjw3-fxm2-vph2, UBUNTU-CVE-2026-90291.