Executive brief
The Linux kernel's module loading system contains a use-after-free vulnerability in the duplicate module request handling code. An attacker with local access could exploit this race condition to crash the system or potentially achieve kernel code execution, disrupting system stability and security.
Technical details
The kmod dups code attempted to manage the lifetime of kmod_dup_req instances using RCU (Read-Copy-Update), but the implementation was flawed. The kmod_dup_request_delete() function would remove the structure from the list, call synchronize_rcu(), and free it; however, parallel callers in kmod_dup_request_exists_wait() did not enter RCU read-side critical sections, creating a use-after-free window. The vulnerability occurs because kmod_dup_request_exists_wait() needs to hold a valid reference across blocking operations, making RCU unsuitable. The fix replaces RCU with explicit reference counting (refcount_t) to safely manage object lifetime across blocking waits. The vulnerability requires local access to trigger but can result in kernel memory corruption.
Affected products
- Linux Linux kernel Multiple versions (kernel/module/dups.c component affected across stable branches from 2.6.11.y through 7.2.y and rolling stable/LTS)
Timeline
- 2026-09-17: disclosed
- 2026-08-06: patched: Fix committed upstream; backported to stable branches
- 2026-09-14: other: Stable kernel inclusion by Greg Kroah-Hartman