CVE-2026-90140

A flaw was found in the Linux kernel's cuse module. This vulnerability, a Use-After-Free, occurs when the cuse module is unloaded before a pending Read-Copy-Update (RCU) callback has completed. This can lead to a system crash or, under specific circumstances, allow a local attacker to execute arbitrary code by reusing the freed memory.

A moderate-impact use-after-free flaw was found in the Linux kernel's cuse (character device in userspace) module. Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"), fuse_conn_put() releases the fuse_conn asynchronously through call_rcu(), and for cuse the release callback cuse_fc_release() is part of the cuse module itself. If the cuse module is unloaded before the pending RCU callback runs, the callback executes code in module text that has already been freed with vfree(), causing a kernel page fault and system crash; if the freed virtual address is subsequently reused, the stale callback could in specific circumstances execute unrelated code, potentially allowing a local attacker to execute arbitrary code. Red Hat rates this flaw Moderate severity with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): triggering it requires local access with privileges sufficient to load and unload kernel modules plus a race between module unload and the outstanding RCU grace period, so the practical impact is loss of availability rather than reliable code execution. The flaw affects the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2, for which the fix is currently deferred; residual risk while the fix is deferred is limited to local privileged users able to unload the cuse module, with a kernel panic being the most likely outcome. Red Hat Enterprise Linux 7, 8, and 9, including the kernel-rt real-time variants, and the RHEL CoreOS kernels shipped with OpenShift Container Platform 4 are not affected because the vulnerable code, introduced with the RCU-delayed fuse_conn release, is not present in those kernels. Upstream fixed the issue by calling rcu_barrier() in cuse_exit() so that any pending fuse_conn release callback completes before the module is removed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.