Look up another CVE · open CVE-2026-90291 in the interactive tracker
CVE-2026-90291
module/dups: Fix use-after-free in kmod_dup_req lifetime handling
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem kernel/module. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-90291 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed only after it is no longer referenced. When releasing an instance, the kmod_dup_request_delete() function removes the kmod_dup_req from the dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it. However, this doesn't work correctly because parallel users referencing the instance in kmod_dup_request_exists_wait() don't enter an RCU read-side critical section. This can result in a use-after-free. The kmod_dup_request_exists_wait() function may need to hold a valid reference to a kmod_dup_req instance across a blocking wait until the corresponding modprobe command completes. This makes it unsuitable for RCU. Fix the issue by changing the lifecycle management of kmod_dup_req to use reference counting.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/module/dups.c
- What this is
- MODULE SUPPORTMAINTAINERS section matched on kernel/module/ · linux-modules@vger.kernel.org · Maintained
Check it on the machine
grep -wE 'CONFIG_MODULES|CONFIG_MODULE_DEBUG_AUTOLOAD_DUPS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code in 4 releases. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixie, forky, sid, bookworm · linux-6.12n
- ?
- not established - no Makefile entry for the affected file
- n
- not enabled on any flavour - this release does not build the code
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_MODULES, CONFIG_MODULE_DEBUG_AUTOLOAD_DUPS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- kernel/module
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.4 | 6.12.110 | 2c85e0fb528e |
| 6.4 | 6.18.52 | b2709aad7599 |
| 6.4 | 7.2.6 | cd2396fc9684 |
| 6.4 | 7.3 | 5eecb11b543f |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is in kmod_dup_request_exists_wait(), reached from __request_module() when tracking a duplicate autoload. An unprivileged process hits that via socket(2) → __sys_socket() → __sock_create(), which calls request_module("net-pf-%d") for an unloaded protocol family; the trigger is that local syscall, not a remote protocol message.
- AC:LAttack complexity, low
- The attacker drives both sides: one socket() call's request_module() inserts a kmod_dup_req and kmod_dup_request_announce() queues kmod_dup_request_delete() for 60*HZ, then further socket() calls look up that entry, drop kmod_dup_mutex, and wait_for_completion_state() on first_req_done without rcu_read_lock, racing the delayed kfree.
- PR:LPrivileges required, low
- __request_module() has no capable() check; it only calls security_kernel_module_request(), whose default LSM hook returns 0. __sock_create()'s request_module("net-pf-%d") path has no capability gate either, so a normal unprivileged local user can trigger the duplicate-autoload race.
- UI:NUser interaction, none
- The attacker issues their own socket() syscalls to force concurrent request_module() calls for the same net-pf-%d name; no other user must mount a filesystem, open a file, or otherwise cooperate.
- S:UScope, unchanged
- The use-after-free is of a kmalloc'd kmod_dup_req in kernel/module/dups.c and corrupts host kernel heap. That is a standard in-kernel privilege-escalation impact inside one security authority, not a VM or IOMMU boundary crossing.
- C:HConfidentiality impact, high
- After kmod_dup_request_delete() kfree()s the kmod_dup_req, a racing kmod_dup_request_exists_wait() still reads kmod_req->dup_ret and takes first_req_done.wait.lock inside wait_for_common(). Reclaiming that slab lets the attacker control those contents, a UAF read primitive.
- I:HIntegrity impact, high
- wait_for_common() takes first_req_done.wait.lock and can __prepare_to_swait() onto the completion wait queue in the already-freed kmod_dup_req. Heap spraying that object yields an attacker-controlled wait-queue/list write, a UAF write and control-flow hijack primitive.
- A:HAvailability impact, high
- Using a freed kmod_dup_req's completion spinlock in wait_for_common(), or kfree() racing wait_for_completion_state(&kmod_req->first_req_done), oopses or panics the kernel even without a full exploit.