FKIE_CVE-2026-90140

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"), fuse_conn_put() frees the fuse_conn through call_rcu() rather than synchronously. For cuse, fc->release is cuse_fc_release(), which lives in the cuse module. If the module is removed before the RCU grace period ends, the callback jumps into freed module memory: userspace / module unload | RCU softirq ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ close(/dev/cuse) | cuse_channel_release() | fuse_dev_release() | fuse_conn_put(fch->conn) | call_rcu(delayed_release) ------+---> callback queued | rmmod cuse | cuse_exit() | cuse_channel_destroy() | ... | return | | <module text freed> | | rcu_do_batch() | delayed_release() | fc->release() | -> cuse_fc_release() | ^^^ freed text! The freed module text is unmapped by vfree(), so the jump into the stale callback triggers a page-fault Oops. If the virtual address is subsequently reused, the callback could execute unrelated code (undefined behaviour). Fix this by calling rcu_barrier() in cuse_exit() so that any pending fuse_conn release callback completes before the module is removed.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/389bd349ddbcf90dbd8a4f2a4ab6e552d53df134
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4deb3edead0c0e172cc7349e8855d741d3c5e162
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7fe415e1cd8fa875be263670c0ab47109818abb6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ac5c499413385cea3e0220d6050408d50842891d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c40f3f24839f8404325a2099e26c2a04786ae309
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/cuse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7fe415e1cd8fa875be263670c0ab47109818abb6",
              "status": "affected",
              "version": "bfbab62ca69f72bcd14ea30de1fb98f6080ad464",
              "versionType": "git"
            },
            {
              "lessThan": "45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e",
              "status": "affected",
              "version": "a8f650b93e55764ca9ff8e1ddebc151f57024086",
              "versionType": "git"
            },
            {
              "lessThan": "ac5c499413385cea3e0220d6050408d50842891d",
              "status": "affected",
              "version": "535e9bd0e8f8d8cfdc29de7cdb902b5041427fe6",
              "versionType": "git"
            },
            {
              "lessThan": "a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9",
              "status": "affected",
              "version": "053fc4f755ad43cf35210677bcba798ccdc48d0c",
              "versionType": "git"
            },
            {
              "lessThan": "389bd349ddbcf90dbd8a4f2a4ab6e552d53df134",
              "status": "affected",
              "version": "053fc4f755ad43cf35210677bcba798ccdc48d0c",
              "versionType": "git"
            },
            {
              "lessThan": "c40f3f24839f8404325a2099e26c2a04786ae309",
              "status": "affected",
              "version": "053fc4f755ad43cf35210677bcba798ccdc48d0c",
              "versionType": "git"
            },
            {
              "lessThan": "4deb3edead0c0e172cc7349e8855d741d3c5e162",
              "status": "affected",
              "version": "053fc4f755ad43cf35210677bcba798ccdc48d0c",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.48",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/cuse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncuse: wait for pending RCU callbacks on module exit\n\nSince commit 053fc4f755ad (\"fuse: fix UAF in rcu pathwalks\"),\nfuse_conn_put() frees the fuse_conn through call_rcu() rather than\nsynchronously.  For cuse, fc-\u003erelease is cuse_fc_release(), which\nlives in the cuse module.  If the module is removed before the RCU\ngrace period ends, the callback jumps into freed module memory:\n\n      userspace / module unload      |        RCU softirq\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n close(/dev/cuse)                    |\n  cuse_channel_release()             |\n   fuse_dev_release()                |\n    fuse_conn_put(fch-\u003econn)         |\n     call_rcu(delayed_release) ------+---\u003e callback queued\n                                     |\n rmmod cuse                          |\n  cuse_exit()                        |\n   cuse_channel_destroy()            |\n   ...                               |\n   return                            |\n                                     |\n \u003cmodule text freed\u003e                 |\n                                     |  rcu_do_batch()\n                                     |   delayed_release()\n                                     |    fc-\u003erelease()\n                                     |     -\u003e cuse_fc_release()\n                                     |        ^^^ freed text!\n\nThe freed module text is unmapped by vfree(), so the jump into the\nstale callback triggers a page-fault Oops.  If the virtual address\nis subsequently reused, the callback could execute unrelated code\n(undefined behaviour).\n\nFix this by calling rcu_barrier() in cuse_exit() so that any pending\nfuse_conn release callback completes before the module is removed."
    }
  ],
  "id": "CVE-2026-90140",
  "lastModified": "2026-09-17T17:17:06.710",
  "metrics": {},
  "published": "2026-09-17T17:17:06.710",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/389bd349ddbcf90dbd8a4f2a4ab6e552d53df134"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4deb3edead0c0e172cc7349e8855d741d3c5e162"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7fe415e1cd8fa875be263670c0ab47109818abb6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ac5c499413385cea3e0220d6050408d50842891d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c40f3f24839f8404325a2099e26c2a04786ae309"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.