CVE-2026-90140 - Vulnerability Details

- cuse: wait for pending RCU callbacks on module exit

Description

In the Linux kernel, the following vulnerability has been resolved:

cuse: wait for pending RCU callbacks on module exit

Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"),
fuse_conn_put() frees the fuse_conn through call_rcu() rather than
synchronously. For cuse, fc->release is cuse_fc_release(), which
lives in the cuse module. If the module is removed before the RCU
grace period ends, the callback jumps into freed module memory:

userspace / module unload | RCU softirq
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
close(/dev/cuse) |
cuse_channel_release() |
fuse_dev_release() |
fuse_conn_put(fch->conn) |
call_rcu(delayed_release) ------+---> callback queued
|
rmmod cuse |
cuse_exit() |
cuse_channel_destroy() |
... |
return |
|
<module text freed> |
| rcu_do_batch()
| delayed_release()
| fc->release()
| -> cuse_fc_release()
| ^^^ freed text!

The freed module text is unmapped by vfree(), so the jump into the
stale callback triggers a page-fault Oops. If the virtual address
is subsequently reused, the callback could execute unrelated code
(undefined behaviour).

Fix this by calling rcu_barrier() in cuse_exit() so that any pending
fuse_conn release callback completes before the module is removed.

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The cuse module in the Linux kernel uses RCU callbacks to free resources. If the module is unloaded before the RCU grace period ends, the queued release callback runs against memory that has already been freed, causing a use‑after‑free. This results in a kernel page‑fault Oops; if the freed address later holds other data, the callback could execute unintended code in kernel space.

Affected Systems

Linux kernels that contain the cuse module and lack the commit adding an rcu_barrier() in cuse_exit are affected. All distributions shipping such unpatched kernels are susceptible, including common LTS releases and mainstream distributions.

Risk and Exploitability

The vulnerability has a very low estimated EPSS score of less than 1% and is not listed in CISA KEV, indicating a low likelihood of current exploitation. However, the impact is severe, as the use‑after‑free can cause a kernel crash or, if the freed memory is reused, arbitrary code execution in kernel mode. Exploitation requires the ability to unload the cuse module, which typically requires elevated privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bfbab62ca69f72bcd14ea30de1fb98f6080ad464`	affected	< 7fe415e1cd8fa875be263670c0ab47109818abb6
`a8f650b93e55764ca9ff8e1ddebc151f57024086`	affected	< 45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e
`535e9bd0e8f8d8cfdc29de7cdb902b5041427fe6`	affected	< ac5c499413385cea3e0220d6050408d50842891d
`053fc4f755ad43cf35210677bcba798ccdc48d0c`	affected	< a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9
`053fc4f755ad43cf35210677bcba798ccdc48d0c`	affected	< 389bd349ddbcf90dbd8a4f2a4ab6e552d53df134
`053fc4f755ad43cf35210677bcba798ccdc48d0c`	affected	< c40f3f24839f8404325a2099e26c2a04786ae309
`053fc4f755ad43cf35210677bcba798ccdc48d0c`	affected	< 4deb3edead0c0e172cc7349e8855d741d3c5e162
`5.15.166`	affected	< 5.15.221
`6.1.107`	affected	< 6.1.188
`6.6.48`	affected	< 6.6.157

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bfbab62ca69f72bcd14ea30de1fb98f6080ad464,7fe415e1cd8fa875be263670c0ab47109818abb6)`	affected	code_commit	—
`[a8f650b93e55764ca9ff8e1ddebc151f57024086,45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e)`	affected	code_commit	—
`[535e9bd0e8f8d8cfdc29de7cdb902b5041427fe6,ac5c499413385cea3e0220d6050408d50842891d)`	affected	code_commit	—
`[053fc4f755ad43cf35210677bcba798ccdc48d0c,a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9)`	affected	code_commit	—
`[053fc4f755ad43cf35210677bcba798ccdc48d0c,389bd349ddbcf90dbd8a4f2a4ab6e552d53df134)`	affected	code_commit	—
`[053fc4f755ad43cf35210677bcba798ccdc48d0c,c40f3f24839f8404325a2099e26c2a04786ae309)`	affected	code_commit	—
`[053fc4f755ad43cf35210677bcba798ccdc48d0c,4deb3edead0c0e172cc7349e8855d741d3c5e162)`	affected	code_commit	—
`[5.15.166,5.15.221)`	affected	semver	—
`[6.1.107,6.1.188)`	affected	semver	—
`[6.6.48,6.6.157)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	generic	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates the rcu_barrier fix in cuse_exit, as introduced by commit 053fc4f755ad.
If a kernel update is pending, schedule the upgrade as a priority to eliminate the use‑after‑free condition.
For systems that rely on the cuse module, avoid unloading it while it is in use; disable the module if it is not required for functionality.

Generated by OpenCVE AI on September 20, 2026 at 03:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00205.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/389bd349ddbcf90dbd8a4f2a4ab6e552d53df134
https://git.kernel.org/stable/c/45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e
https://git.kernel.org/stable/c/4deb3edead0c0e172cc7349e8855d741d3c5e162
https://git.kernel.org/stable/c/7fe415e1cd8fa875be263670c0ab47109818abb6
https://git.kernel.org/stable/c/a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9
https://git.kernel.org/stable/c/ac5c499413385cea3e0220d6050408d50842891d
https://git.kernel.org/stable/c/c40f3f24839f8404325a2099e26c2a04786ae309

History

Sun, 20 Sep 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"), fuse_conn_put() frees the fuse_conn through call_rcu() rather than synchronously. For cuse, fc->release is cuse_fc_release(), which lives in the cuse module. If the module is removed before the RCU grace period ends, the callback jumps into freed module memory: userspace / module unload \| RCU softirq ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ close(/dev/cuse) \| cuse_channel_release() \| fuse_dev_release() \| fuse_conn_put(fch->conn) \| call_rcu(delayed_release) ------+---> callback queued \| rmmod cuse \| cuse_exit() \| cuse_channel_destroy() \| ... \| return \| \| <module text freed> \| \| rcu_do_batch() \| delayed_release() \| fc->release() \| -> cuse_fc_release() \| ^^^ freed text! The freed module text is unmapped by vfree(), so the jump into the stale callback triggers a page-fault Oops. If the virtual address is subsequently reused, the callback could execute unrelated code (undefined behaviour). Fix this by calling rcu_barrier() in cuse_exit() so that any pending fuse_conn release callback completes before the module is removed.
Title		cuse: wait for pending RCU callbacks on module exit
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/389bd349ddbcf90dbd8a4f2a4ab6e552d53df134 https://git.kernel.org/stable/c/45ae914b2f6ea56fc2f1c017fdee4e995bcb4c0e https://git.kernel.org/stable/c/4deb3edead0c0e172cc7349e8855d741d3c5e162 https://git.kernel.org/stable/c/7fe415e1cd8fa875be263670c0ab47109818abb6 https://git.kernel.org/stable/c/a1b46aee33d83f14ed62d7fdef1a91d3e0b732a9 https://git.kernel.org/stable/c/ac5c499413385cea3e0220d6050408d50842891d https://git.kernel.org/stable/c/c40f3f24839f8404325a2099e26c2a04786ae309

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:06:37.824Z

Updated: 2026-09-17T16:06:37.824Z

Reserved: 2026-09-11T19:38:34.789Z

Link: CVE-2026-90140

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:06.710

Modified: 2026-09-17T17:17:06.710

Link: CVE-2026-90140

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T03:15:08Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object