CVE-2026-80856

fuse: fix invalidate lock leak on setattr writeback failure

Published Sep 4, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix invalidate lock leak on setattr writeback failure

fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate
(fault_blocked = true) and releases it at the out:/error: labels. But
when a writeback flush is also needed, a write_inode_now() failure
returns directly and leaks the lock, so any later fault or truncate on
the file stalls on the stale rwsem.

For example, truncate(2) on a setuid file reaches fuse_do_setattr()
with both ATTR_SIZE and ATTR_MODE set:

truncate(2)
└─ do_truncate()
├─ dentry_needs_remove_privs() # S_ISUID
└─ notify_change() # KILL_SUID -> ATTR_MODE
└─ fuse_setattr() # no killpriv:
│ # ia_valid |= ATTR_MODE
└─ fuse_do_setattr()
├─ filemap_invalidate_lock() # IS_DAX && is_truncate
└─ write_inode_now() # is_wb && ATTR_MODE
└─ if (err) # e.g. daemon -> -EIO
return err # <- lock leaked

Fix this by adding an unlock label that releases the lock before
returning the error, and use it for the fuse_dax_break_layouts()
failure path as well.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6ae330cad6ef22ab8347ea9e0707dc56a7c7363f`	affected	< 92faaee1b108c6e4b07730d20896a6593a85f675
`6ae330cad6ef22ab8347ea9e0707dc56a7c7363f`	affected	< 8f14906ce9103ab8f2f1ebda45935a0d61b9d763
`6ae330cad6ef22ab8347ea9e0707dc56a7c7363f`	affected	< 03cfeeb135428fa83f0791d3f8f94d9298cae695
`6ae330cad6ef22ab8347ea9e0707dc56a7c7363f`	affected	< 92588d187ba4697a322e7aefe5d9e538a87d1cd2
`6ae330cad6ef22ab8347ea9e0707dc56a7c7363f`	affected	< ea9fea370b8de4ffd72e0ef89550415c15637787
`6ae330cad6ef22ab8347ea9e0707dc56a7c7363f`	affected	< 1758730d9eaa3c06cf415c3446d9f6eed9ed3eed
`6ae330cad6ef22ab8347ea9e0707dc56a7c7363f`	affected	< dd278d954c0e96a9cbd3cc491e07b8267d25f8d5
`6ae330cad6ef22ab8347ea9e0707dc56a7c7363f`	affected	< e8457ebfd77a46e8d1210e8888ea914ad064558e
`6ae330cad6ef22ab8347ea9e0707dc56a7c7363f`	affected	< 9afeca0d569c9fc89d758fe7a9339d1e8afb1546

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`5.10.273`	unaffected	≤ 5.10.*
`5.15.220`	unaffected	≤ 5.15.*
`6.1.187`	unaffected	≤ 6.1.*
`6.6.156`	unaffected	≤ 6.6.*
`6.12.108`	unaffected	≤ 6.12.*
`6.18.49`	unaffected	≤ 6.18.*
`7.1.13`	unaffected	≤ 7.1.*
`7.2.3`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6ae330cad6ef22ab8347ea9e0707dc56a7c7363f,8f14906ce9103ab8f2f1ebda45935a0d61b9d763)`	affected	code_commit	—
`[6ae330cad6ef22ab8347ea9e0707dc56a7c7363f,03cfeeb135428fa83f0791d3f8f94d9298cae695)`	affected	code_commit	—
`[6ae330cad6ef22ab8347ea9e0707dc56a7c7363f,92588d187ba4697a322e7aefe5d9e538a87d1cd2)`	affected	code_commit	—
`[6ae330cad6ef22ab8347ea9e0707dc56a7c7363f,ea9fea370b8de4ffd72e0ef89550415c15637787)`	affected	code_commit	—
`[6ae330cad6ef22ab8347ea9e0707dc56a7c7363f,1758730d9eaa3c06cf415c3446d9f6eed9ed3eed)`	affected	code_commit	—
`[6ae330cad6ef22ab8347ea9e0707dc56a7c7363f,dd278d954c0e96a9cbd3cc491e07b8267d25f8d5)`	affected	code_commit	—
`[6ae330cad6ef22ab8347ea9e0707dc56a7c7363f,e8457ebfd77a46e8d1210e8888ea914ad064558e)`	affected	code_commit	—
`[6ae330cad6ef22ab8347ea9e0707dc56a7c7363f,9afeca0d569c9fc89d758fe7a9339d1e8afb1546)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.10`	affected	generic	—
`[0,5.10)`	unaffected	generic	—
`[5.15.220,5.16.0)`	unaffected	generic	—
`[6.1.187,6.2.0)`	unaffected	generic	—
`[6.6.156,6.7.0)`	unaffected	generic	—
`[6.12.108,6.13.0)`	unaffected	generic	—
`[6.18.49,6.19.0)`	unaffected	generic	—
`[7.1.13,7.2.0)`	unaffected	generic	—
`[7.2.3,7.3.0)`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.182% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/03cfeeb135428fa83f0791d3f8f94d9298cae695
https://git.kernel.org/stable/c/1758730d9eaa3c06cf415c3446d9f6eed9ed3eed
https://git.kernel.org/stable/c/8f14906ce9103ab8f2f1ebda45935a0d61b9d763
https://git.kernel.org/stable/c/92588d187ba4697a322e7aefe5d9e538a87d1cd2
https://git.kernel.org/stable/c/92faaee1b108c6e4b07730d20896a6593a85f675
https://git.kernel.org/stable/c/9afeca0d569c9fc89d758fe7a9339d1e8afb1546
https://git.kernel.org/stable/c/dd278d954c0e96a9cbd3cc491e07b8267d25f8d5
https://git.kernel.org/stable/c/e8457ebfd77a46e8d1210e8888ea914ad064558e
https://git.kernel.org/stable/c/ea9fea370b8de4ffd72e0ef89550415c15637787

History

Oct 30, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/92faaee1b108c6e4b07730d20896a6593a85f675

Sep 4, 2026 9:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-404 CWE-673

Sep 4, 2026 4:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on setattr writeback failure fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate (fault_blocked = true) and releases it at the out:/error: labels. But when a writeback flush is also needed, a write_inode_now() failure returns directly and leaks the lock, so any later fault or truncate on the file stalls on the stale rwsem. For example, truncate(2) on a setuid file reaches fuse_do_setattr() with both ATTR_SIZE and ATTR_MODE set: truncate(2) └─ do_truncate() ├─ dentry_needs_remove_privs() # S_ISUID └─ notify_change() # KILL_SUID -> ATTR_MODE └─ fuse_setattr() # no killpriv: │ # ia_valid \|= ATTR_MODE └─ fuse_do_setattr() ├─ filemap_invalidate_lock() # IS_DAX && is_truncate └─ write_inode_now() # is_wb && ATTR_MODE └─ if (err) # e.g. daemon -> -EIO return err # <- lock leaked Fix this by adding an unlock label that releases the lock before returning the error, and use it for the fuse_dax_break_layouts() failure path as well.
Title		fuse: fix invalidate lock leak on setattr writeback failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03cfeeb135428fa83f0791d3f8f94d9298cae695 https://git.kernel.org/stable/c/1758730d9eaa3c06cf415c3446d9f6eed9ed3eed https://git.kernel.org/stable/c/8f14906ce9103ab8f2f1ebda45935a0d61b9d763 https://git.kernel.org/stable/c/92588d187ba4697a322e7aefe5d9e538a87d1cd2 https://git.kernel.org/stable/c/9afeca0d569c9fc89d758fe7a9339d1e8afb1546 https://git.kernel.org/stable/c/dd278d954c0e96a9cbd3cc491e07b8267d25f8d5 https://git.kernel.org/stable/c/e8457ebfd77a46e8d1210e8888ea914ad064558e https://git.kernel.org/stable/c/ea9fea370b8de4ffd72e0ef89550415c15637787