{"id":"CVE-2026-90140","revision":"7ae80acbe65b4de39ecc72445db07c71","records":[{"revision":"7ae80acbe65b4de39ecc72445db07c71","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90140","aliases":[],"title":"cuse: wait for pending RCU callbacks on module exit","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncuse: wait for pending RCU callbacks on module exit\n\nSince commit 053fc4f755ad (\"fuse: fix UAF in rcu pathwalks\"),\nfuse_conn_put() frees the fuse_conn through call_rcu() rather than\nsynchronously.  For cuse, fc->release is cuse_fc_release(), which\nlives in the cuse module.  If the module is removed before the RCU\ngrace period ends, the callback jumps into freed module memory:\n\n      userspace / module unload      |        RCU softirq\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n close(/dev/cuse)                    |\n  cuse_channel_release()             |\n   fuse_dev_release()                |\n    fuse_conn_put(fch->conn)         |\n     call_rcu(delayed_release) ------+---> callback queued\n                                     |\n rmmod cuse                          |\n  cuse_exit()                        |\n   cuse_channel_destroy()            |\n   ...                               |\n   return                            |\n                                     |\n <module text freed>                 |\n                                     |  rcu_do_batch()\n                                     |   delayed_release()\n                                     |    fc->release()\n                                     |     -> cuse_fc_release()\n                                     |        ^^^ freed text!\n\nThe freed module text is unmapped by vfree(), so the jump into the\nstale callback triggers a page-fault Oops.  If the virtual address\nis subsequently reused, the callback could execute unrelated code\n(undefined behaviour).\n\nFix this by calling rcu_barrier() in cuse_exit() so that any pending\nfuse_conn release callback completes before the module is removed.","state":0,"publishedAt":"2026-09-17T16:06:37.824+00:00","modifiedAt":"2026-10-19T08:58:38.281+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/fuse/cuse.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"bfbab62ca69f72bcd14ea30de1fb98f6080ad464\",\n                            \"lessThan\": \"7fe415e1cd8fa875be263670c0ab47109818abb6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a8f650b93e55764ca9ff8e1ddebc151f57024086\",\n                            \"lessThan\": \"45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"535e9bd0e8f8d8cfdc29de7cdb902b5041427fe6\",\n                            \"lessThan\": \"ac5c499413385cea3e0220d6050408d50842891d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"053fc4f755ad43cf35210677bcba798ccdc48d0c\",\n                            \"lessThan\": \"a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"053fc4f755ad43cf35210677bcba798ccdc48d0c\",\n                            \"lessThan\": \"389bd349ddbcf90dbd8a4f2a4ab6e552d53df134\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"053fc4f755ad43cf35210677bcba798ccdc48d0c\",\n                            \"lessThan\": \"c40f3f24839f8404325a2099e26c2a04786ae309\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"053fc4f755ad43cf35210677bcba798ccdc48d0c\",\n                            \"lessThan\": \"4deb3edead0c0e172cc7349e8855d741d3c5e162\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.15.166\",\n                            \"lessThan\": \"5.15.221\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.107\",\n                            \"lessThan\": \"6.1.188\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.48\",\n                            \"lessThan\": \"6.6.157\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/fuse/cuse.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/7fe415e1cd8fa875be263670c0ab47109818abb6","https://git.kernel.org/stable/c/45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e","https://git.kernel.org/stable/c/ac5c499413385cea3e0220d6050408d50842891d","https://git.kernel.org/stable/c/a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9","https://git.kernel.org/stable/c/389bd349ddbcf90dbd8a4f2a4ab6e552d53df134","https://git.kernel.org/stable/c/c40f3f24839f8404325a2099e26c2a04786ae309","https://git.kernel.org/stable/c/4deb3edead0c0e172cc7349e8855d741d3c5e162"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90140","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90140","identifiers":["CVE-2026-90140"]},"retained":false,"historicalAffected":[]}],"coverage":[]}