Homepage

CVE-2026-90140 Affecting kernel-tools-devel package, versions <1:6.1.188-233.385.amzn2023

Severity

 Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.21% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-KERNELTOOLSDEVEL-20869025
  • published13 Oct 2026
  • disclosed17 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 17 Sep 2026

NewCVE-2026-90140  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 kernel-tools-devel to version 1:6.1.188-233.385.amzn2023 or higher.
This issue was patched in ALAS2023-2026-3197.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-tools-devel package and not the kernel-tools-devel package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

cuse: wait for pending RCU callbacks on module exit

Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"), fuse_conn_put() frees the fuse_conn through call_rcu() rather than synchronously. For cuse, fc->release is cuse_fc_release(), which lives in the cuse module. If the module is removed before the RCU grace period ends, the callback jumps into freed module memory:

  userspace / module unload      |        RCU softirq

 close(/dev/cuse)                    |
  cuse_channel_release()             |
   fuse_dev_release()                |
    fuse_conn_put(fch-&gt;conn)         |
     call_rcu(delayed_release) ------+---&gt; callback queued
                                     |
 rmmod cuse                          |
  cuse_exit()                        |
   cuse_channel_destroy()            |
   ...                               |
   return                            |
                                     |
 &lt;module text freed&gt;                 |
                                     |  rcu_do_batch()
                                     |   delayed_release()
                                     |    fc-&gt;release()
                                     |     -&gt; cuse_fc_release()
                                     |        ^^^ freed text!


The freed module text is unmapped by vfree(), so the jump into the
stale callback triggers a page-fault Oops.  If the virtual address
is subsequently reused, the callback could execute unrelated code
(undefined behaviour).


Fix this by calling rcu_barrier() in cuse_exit() so that any pending
fuse_conn release callback completes before the module is removed.