CVE-2026-90140 (GCVE-0-2026-90140)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-19 08:58
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"), fuse_conn_put() frees the fuse_conn through call_rcu() rather than synchronously. For cuse, fc->release is cuse_fc_release(), which lives in the cuse module. If the module is removed before the RCU grace period ends, the callback jumps into freed module memory: userspace / module unload | RCU softirq ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ close(/dev/cuse) | cuse_channel_release() | fuse_dev_release() | fuse_conn_put(fch->conn) | call_rcu(delayed_release) ------+---> callback queued | rmmod cuse | cuse_exit() | cuse_channel_destroy() | ... | return | | <module text freed> | | rcu_do_batch() | delayed_release() | fc->release() | -> cuse_fc_release() | ^^^ freed text! The freed module text is unmapped by vfree(), so the jump into the stale callback triggers a page-fault Oops. If the virtual address is subsequently reused, the callback could execute unrelated code (undefined behaviour). Fix this by calling rcu_barrier() in cuse_exit() so that any pending fuse_conn release callback completes before the module is removed.
References
Impacted products
Vendor Product Version
Linux Linux Version: bfbab62ca69f72bcd14ea30de1fb98f6080ad464
Version: a8f650b93e55764ca9ff8e1ddebc151f57024086
Version: 535e9bd0e8f8d8cfdc29de7cdb902b5041427fe6
Version: 053fc4f755ad43cf35210677bcba798ccdc48d0c
Version: 053fc4f755ad43cf35210677bcba798ccdc48d0c
Version: 053fc4f755ad43cf35210677bcba798ccdc48d0c
Version: 053fc4f755ad43cf35210677bcba798ccdc48d0c
Version: 5.15.166   ≤
Version: 6.1.107   ≤
Version: 6.6.48   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/cuse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7fe415e1cd8fa875be263670c0ab47109818abb6",
              "status": "affected",
              "version": "bfbab62ca69f72bcd14ea30de1fb98f6080ad464",
              "versionType": "git"
            },
            {
              "lessThan": "45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e",
              "status": "affected",
              "version": "a8f650b93e55764ca9ff8e1ddebc151f57024086",
              "versionType": "git"
            },
            {
              "lessThan": "ac5c499413385cea3e0220d6050408d50842891d",
              "status": "affected",
              "version": "535e9bd0e8f8d8cfdc29de7cdb902b5041427fe6",
              "versionType": "git"
            },
            {
              "lessThan": "a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9",
              "status": "affected",
              "version": "053fc4f755ad43cf35210677bcba798ccdc48d0c",
              "versionType": "git"
            },
            {
              "lessThan": "389bd349ddbcf90dbd8a4f2a4ab6e552d53df134",
              "status": "affected",
              "version": "053fc4f755ad43cf35210677bcba798ccdc48d0c",
              "versionType": "git"
            },
            {
              "lessThan": "c40f3f24839f8404325a2099e26c2a04786ae309",
              "status": "affected",
              "version": "053fc4f755ad43cf35210677bcba798ccdc48d0c",
              "versionType": "git"
            },
            {
              "lessThan": "4deb3edead0c0e172cc7349e8855d741d3c5e162",
              "status": "affected",
              "version": "053fc4f755ad43cf35210677bcba798ccdc48d0c",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.48",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/cuse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15.166",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.48",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncuse: wait for pending RCU callbacks on module exit\n\nSince commit 053fc4f755ad (\"fuse: fix UAF in rcu pathwalks\"),\nfuse_conn_put() frees the fuse_conn through call_rcu() rather than\nsynchronously.  For cuse, fc-\u003erelease is cuse_fc_release(), which\nlives in the cuse module.  If the module is removed before the RCU\ngrace period ends, the callback jumps into freed module memory:\n\n      userspace / module unload      |        RCU softirq\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n close(/dev/cuse)                    |\n  cuse_channel_release()             |\n   fuse_dev_release()                |\n    fuse_conn_put(fch-\u003econn)         |\n     call_rcu(delayed_release) ------+---\u003e callback queued\n                                     |\n rmmod cuse                          |\n  cuse_exit()                        |\n   cuse_channel_destroy()            |\n   ...                               |\n   return                            |\n                                     |\n \u003cmodule text freed\u003e                 |\n                                     |  rcu_do_batch()\n                                     |   delayed_release()\n                                     |    fc-\u003erelease()\n                                     |     -\u003e cuse_fc_release()\n                                     |        ^^^ freed text!\n\nThe freed module text is unmapped by vfree(), so the jump into the\nstale callback triggers a page-fault Oops.  If the virtual address\nis subsequently reused, the callback could execute unrelated code\n(undefined behaviour).\n\nFix this by calling rcu_barrier() in cuse_exit() so that any pending\nfuse_conn release callback completes before the module is removed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:58:38.281Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7fe415e1cd8fa875be263670c0ab47109818abb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac5c499413385cea3e0220d6050408d50842891d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/389bd349ddbcf90dbd8a4f2a4ab6e552d53df134"
        },
        {
          "url": "https://git.kernel.org/stable/c/c40f3f24839f8404325a2099e26c2a04786ae309"
        },
        {
          "url": "https://git.kernel.org/stable/c/4deb3edead0c0e172cc7349e8855d741d3c5e162"
        }
      ],
      "title": "cuse: wait for pending RCU callbacks on module exit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90140",
    "datePublished": "2026-09-17T16:06:37.824Z",
    "dateReserved": "2026-09-11T19:38:34.789Z",
    "dateUpdated": "2026-10-19T08:58:38.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.