In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc

 1  userspace / module unload      |        RCU softirq

 1 close(/dev/cuse)                    |
 2  cuse_channel_release()             |
 3   fuse_dev_release()                |
 4    fuse_conn_put(fch->conn)         |
 5     call_rcu(delayed_release) ------+---> callback queued
 6                                     |
 7 rmmod cuse                          |
 8  cuse_exit()                        |
 9   cuse_channel_destroy()            |
10   ...                               |
11   return                            |
12                                     |
13 <module text freed>                 |
14                                     |  rcu_do_batch()
15                                     |   delayed_release()
16                                     |    fc->release()
17                                     |     -> cuse_fc_release()
18                                     |        ^^^ freed text!
19 
20The freed module text is unmapped by vfree(), so the jump into the
21stale callback triggers a page-fault Oops.  If the virtual address
22is subsequently reused, the callback could execute unrelated code
23(undefined behaviour).
24 
25Fix this by calling rcu_barrier() in cuse_exit() so that any pending
26fuse_conn release callback completes before the module is removed.