CVE-2026-90291

In the Linux kernel, the following vulnerability has been resolved:

module/dups: Fix use-after-free in kmod_dup_req lifetime handling

The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed

only after it is no longer referenced. When releasing an instance, the

kmod_dup_request_delete() function removes the kmod_dup_req from the

dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.

However, this doesn't work correctly because parallel users referencing the

instance in kmod_dup_request_exists_wait() don't enter an RCU read-side

critical section. This can result in a use-after-free.

The kmod_dup_request_exists_wait() function may need to hold a valid

reference to a kmod_dup_req instance across a blocking wait until the

corresponding modprobe command completes. This makes it unsuitable for RCU.

Fix the issue by changing the lifecycle management of kmod_dup_req to use

reference counting.