Answer in brief
CVE-2026-90291 records a High severity (CVSS 7.8) vulnerability in module/dups: Fix use-after-free in kmod_dup_req lifetime handling. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8660484ed1cf3261e89e0bad94c6395597e87599 <2c85e0fb528e039aa8ea1e9c2a1f64347f990541 || >=8660484ed1cf3261e89e0bad94c6395597e87599 <b2709aad7599f6fd957939b60f4a8323c8f08072 || >=8660484ed1cf3261e89e0bad94c6395597e87599 <cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca || >=8660484ed1cf3261e89e0bad94c6395597e87599 <5eecb11b543f9f417bcf0dea239ff99c6af65dbd | 2c85e0fb528e039aa8ea1e9c2a1f64347f990541, b2709aad7599f6fd957939b60f4a8323c8f08072, cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca, 5eecb11b543f9f417bcf0dea239ff99c6af65dbd |
| Linux/Linuxgeneric | 6.4 | Not reported |
| Linux/Linuxgeneric | >=8660484ed1cf3261e89e0bad94c6395597e87599 <a3205bd1f218053575589b14caf8df667f344134 || >=8660484ed1cf3261e89e0bad94c6395597e87599 <2c85e0fb528e039aa8ea1e9c2a1f64347f990541 || >=8660484ed1cf3261e89e0bad94c6395597e87599 <b2709aad7599f6fd957939b60f4a8323c8f08072 || >=8660484ed1cf3261e89e0bad94c6395597e87599 <cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca || >=8660484ed1cf3261e89e0bad94c6395597e87599 <5eecb11b543f9f417bcf0dea239ff99c6af65dbd | a3205bd1f218053575589b14caf8df667f344134, 2c85e0fb528e039aa8ea1e9c2a1f64347f990541, b2709aad7599f6fd957939b60f4a8323c8f08072, cd2396fc9684d2cfd3f3c3f09c79d6d9d725b0ca, 5eecb11b543f9f417bcf0dea239ff99c6af65dbd |
Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 17, 2026
In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmod_dup_req lifetime handling The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed only after it is no longer referenced. When releasing an instance, the kmod_dup_request_delete() function removes the kmod_dup_req from the dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it. However, this doesn't work correctly because parallel users referencing the instance in kmod_dup_request_exists_wait() don't enter an RCU read-side critical section. This can result in a use-after-free. The kmod_dup_request_exists_wait() function may need to hold a valid reference to a kmod_dup_req instance across a blocking wait until the corresponding modprobe command completes. This makes it unsuitable for RCU. Fix the issue by changing the lifecycle management of kmod_dup_req to use reference counting.
Quoted source text, attributed separately from HOL analysis.