https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:39:26 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90140 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>cuse: wait for pending RCU callbacks on module exit</p> <p>Since commit 053fc4f755ad (&#34;fuse: fix UAF in rcu pathwalks&#34;), fuse_conn_put() frees the fuse_conn through call_rcu() rather than synchronously. For cuse, fc-&gt;release is cuse_fc_release(), which lives in the cuse module. If the module is removed before the RCU grace period ends, the callback jumps into freed module memory:</p> <p>userspace / module unload | RCU softirq ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ close(/dev/cuse) | cuse_channel_release() | fuse_dev_release() | fuse_conn_put(fch-&gt;conn) | call_rcu(delayed_release) ------+---&gt; callback queued | rmmod cuse | cuse_exit() | cuse_channel_destroy() | ... | return | | &lt;module text freed&gt; | | rcu_do_batch() | delayed_release() | fc-&gt;release() | -&gt; cuse_fc_release() | ^^^ freed text!</p> <p>The freed module text is unmapped by vfree(), so the jump into the stale callback triggers a pag…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>cuse: wait for pending RCU callbacks on module exit</p> <p>Since commit 053fc4f755ad (&#34;fuse: fix UAF in rcu pathwalks&#34;), fuse_conn_put() frees the fuse_conn through call_rcu() rather than synchronously. For cuse, fc-&gt;release is cuse_fc_release(), which lives in the cuse module. If the module is removed before the RCU grace period ends, the callback jumps into freed module memory:</p> <p>userspace / module unload | RCU softirq ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ close(/dev/cuse) | cuse_channel_release() | fuse_dev_release() | fuse_conn_put(fch-&gt;conn) | call_rcu(delayed_release) ------+---&gt; callback queued | rmmod cuse | cuse_exit() | cuse_channel_destroy() | ... | return | | &lt;module text freed&gt; | | rcu_do_batch() | delayed_release() | fc-&gt;release() | -&gt; cuse_fc_release() | ^^^ freed text!</p> <p>The freed module text is unmapped by vfree(), so the jump into the stale callback triggers a pag…</p> https://vulnerability.circl.lu/vuln/cve-2026-90140