Index: busybox-1.31.1/modutils/modprobe.c
===================================================================
--- busybox-1.31.1.orig/modutils/modprobe.c	2019-06-10 18:50:53.000000000 +0800
+++ busybox-1.31.1/modutils/modprobe.c	2021-03-29 12:01:36.027162311 +0800
@@ -216,6 +216,17 @@
 {
 	struct module_entry *m;
 
+    /*
+    * get_or_add_modentry() strips path from name and works
+    * on remaining basename.
+    * This would make "rmmod dir/name" and "modprobe dir/name"
+    * to work like "rmmod name" and "modprobe name",
+    * which is wrong, and can be abused via implicit modprobing:
+    * "ifconfig /usbserial up" tries to modprobe netdev-/usbserial.
+    */
+    if (strchr(name, '/'))
+        bb_error_msg_and_die("malformed module name '%s'", name);
+
 	m = get_or_add_modentry(name);
 	if (!(option_mask32 & (OPT_REMOVE | OPT_SHOW_DEPS))
 	 && (m->flags & (MODULE_FLAG_LOADED | MODULE_FLAG_BUILTIN))